0de5e6783719c4d59f57de40f09ed2cfaa14914a9f47762fd1c7190391b939a8

General

Target

Tracking No_SINI0068206497.exe
Size

665KB
MD5

e0dc70ee903578f318c13508b381f133
SHA1

1ec861971ae1243f1ea9b0d3005c98e80b497315
SHA256

0de5e6783719c4d59f57de40f09ed2cfaa14914a9f47762fd1c7190391b939a8
SHA512

26a139bc6d81d9c9b12a752c554a7e89a0754032f5c5dfc7d572c35c4ea64d3826c237a6dc32b26b0d6e8157c69f0a1b2231379b61ed3967f5464722190f441f

Score

6^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1492	Tracking No_SINI0068206497.exe
1492	Tracking No_SINI0068206497.exe
1492	Tracking No_SINI0068206497.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1032	1492	Tracking No_SINI0068206497.exe	24
PID 1492 wrote to memory of 1032	1492	Tracking No_SINI0068206497.exe	24
PID 1492 wrote to memory of 1032	1492	Tracking No_SINI0068206497.exe	24
PID 1492 wrote to memory of 1032	1492	Tracking No_SINI0068206497.exe	24
PID 1032 wrote to memory of 1500	1032	cmd.exe	26
PID 1032 wrote to memory of 1500	1032	cmd.exe	26
PID 1032 wrote to memory of 1500	1032	cmd.exe	26
PID 1032 wrote to memory of 1500	1032	cmd.exe	26
PID 1492 wrote to memory of 1912	1492	Tracking No_SINI0068206497.exe	28
PID 1492 wrote to memory of 1912	1492	Tracking No_SINI0068206497.exe	28
PID 1492 wrote to memory of 1912	1492	Tracking No_SINI0068206497.exe	28
PID 1492 wrote to memory of 1912	1492	Tracking No_SINI0068206497.exe	28
PID 1492 wrote to memory of 1912	1492	Tracking No_SINI0068206497.exe	28
PID 1492 wrote to memory of 1912	1492	Tracking No_SINI0068206497.exe	28
PID 1492 wrote to memory of 1912	1492	Tracking No_SINI0068206497.exe	28

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1912	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\kasmir = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\Desktop\\kasmir"	reg.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000_Classes\Local Settings	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	Tracking No_SINI0068206497.exe

C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.exe
"C:\Users\Admin\AppData\Local\Temp\Tracking No_SINI0068206497.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v kasmir /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\kasmir"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v kasmir /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\kasmir"
    3⤵
    - Adds Run key to start application
    PID:1500
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\kasmir
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Modifies registry class
  PID:1912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads