123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e

General

Target
123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe
Size 3.6MB
Sample200901-lgafcldta2
SHA256 123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e
MD5 8840b88b1fff6e2f8d4f3965b9a190d2
SHA1 3b65221b333c5f0fef977dd0ade0fd288bedb942
SHA512 1365951fa0cf0548abe4a68227676e597dfcd421689d3bd3b946422d2b54d05673525cf72b8713511b2481b75b431fd7682bc35b592f42c927253a65b362d141
MD5 SHA1 SHA512

Score

8^/10

Drops file in Drivers directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\GmProtect.sys	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe
File created	C:\Windows\SysWOW64\drivers\GmProtect-x64.sys	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe
File created	C:\Windows\SysWOW64\drivers\PlJT4.exe	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe
File created	C:\Windows\SysWOW64\drivers\ProtectApi.dll	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe
File created	C:\Windows\System32\Drivers\705A0FEC.sys	PlJT4.exe
File opened for modification	C:\Windows\System32\Drivers\705A0FEC.sys	PlJT4.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe

Executes dropped EXE 1 IoCs

pid	Process
1232	PlJT4.exe

Loads dropped DLL 1 IoCs

pid	Process
1232	PlJT4.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 3e9fec284180d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
612	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3248	svchost.exe
Token: SeCreatePagefilePrivilege	3248	svchost.exe
Token: SeDebugPrivilege	964	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
964	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe
964	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 900	964	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe	72
PID 964 wrote to memory of 900	964	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe	72
PID 964 wrote to memory of 900	964	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe	72
PID 964 wrote to memory of 1232	964	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe	74
PID 964 wrote to memory of 1232	964	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe	74
PID 964 wrote to memory of 1232	964	123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe	74

C:\Users\Admin\AppData\Local\Temp\123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe
"C:\Users\Admin\AppData\Local\Temp\123f17fcd035b40ddff50b0c592ecaff3e58846f6c5f37afe84bd5a1b6df176e.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd /c rd "C:\Windows\system32\drivers\etcup0Nr" /S /Q
  2⤵
  PID:900
- C:\Windows\SysWOW64\drivers\PlJT4.exe
  "C:\Windows\system32\drivers\PlJT4.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1232