66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af

Analysis

max time kernel
66s
max time network
126s
platform
windows10_x64
resource
win10v20201028
submitted
06-11-2020 15:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe
Size

256KB
MD5

ada523db2c2418fa37398c41b370c125
SHA1

7c2c197b14447cbf4bd0d040a36493ec1d9d8bc7
SHA256

66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af
SHA512

849e06f1308ef00d1cf5ac71d9deb5699bae0e3985bca11525d3a95879325d1c11ad30f7c1bf80ef51ccc71032ab793ac2bef305c051391c9cefd91253621343

Score

9^/10

persistence

Malware Config

Signatures

ServiceHost packer 13 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/2208-15-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-14-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-16-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-18-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-17-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-21-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-20-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-19-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-22-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-23-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-25-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-26-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/2208-24-0x0000000000000000-mapping.dmp	servicehost

Executes dropped EXE 1 IoCs

Processes:

TrustedInstaller.exe

pid process

2208 TrustedInstaller.exe

pid	process
2208	TrustedInstaller.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run	66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\TrustedInstaller.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\TrustedInstaller.exe\" -start"	66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

TrustedInstaller.exe

description	ioc	process
File opened (read-only)	\??\I:	TrustedInstaller.exe
File opened (read-only)	\??\H:	TrustedInstaller.exe
File opened (read-only)	\??\W:	TrustedInstaller.exe
File opened (read-only)	\??\U:	TrustedInstaller.exe
File opened (read-only)	\??\K:	TrustedInstaller.exe
File opened (read-only)	\??\G:	TrustedInstaller.exe
File opened (read-only)	\??\F:	TrustedInstaller.exe
File opened (read-only)	\??\A:	TrustedInstaller.exe
File opened (read-only)	\??\V:	TrustedInstaller.exe
File opened (read-only)	\??\Q:	TrustedInstaller.exe
File opened (read-only)	\??\L:	TrustedInstaller.exe
File opened (read-only)	\??\R:	TrustedInstaller.exe
File opened (read-only)	\??\O:	TrustedInstaller.exe
File opened (read-only)	\??\J:	TrustedInstaller.exe
File opened (read-only)	\??\E:	TrustedInstaller.exe
File opened (read-only)	\??\Y:	TrustedInstaller.exe
File opened (read-only)	\??\X:	TrustedInstaller.exe
File opened (read-only)	\??\S:	TrustedInstaller.exe
File opened (read-only)	\??\N:	TrustedInstaller.exe
File opened (read-only)	\??\M:	TrustedInstaller.exe
File opened (read-only)	\??\B:	TrustedInstaller.exe
File opened (read-only)	\??\Z:	TrustedInstaller.exe
File opened (read-only)	\??\T:	TrustedInstaller.exe
File opened (read-only)	\??\P:	TrustedInstaller.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 geoiptool.com
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3896 2208 WerFault.exe TrustedInstaller.exe

flow	ioc
8	geoiptool.com

pid	pid_target	process	target process
3896	2208	WerFault.exe	TrustedInstaller.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

WerFault.exe

pid	process
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe
3896	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

WerFault.exe

description pid process

Token: SeRestorePrivilege 3896 WerFault.exe
Token: SeBackupPrivilege 3896 WerFault.exe
Token: SeDebugPrivilege 3896 WerFault.exe

description	pid	process
Token: SeRestorePrivilege	3896	WerFault.exe
Token: SeBackupPrivilege	3896	WerFault.exe
Token: SeDebugPrivilege	3896	WerFault.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe

description	pid	process	target process
PID 4076 wrote to memory of 2208	4076	66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe	TrustedInstaller.exe
PID 4076 wrote to memory of 2208	4076	66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe	TrustedInstaller.exe
PID 4076 wrote to memory of 2208	4076	66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe	TrustedInstaller.exe

C:\Users\Admin\AppData\Local\Temp\66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe
"C:\Users\Admin\AppData\Local\Temp\66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af.bin.exe"
1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4076

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -start
2⤵
- Executes dropped EXE
- Enumerates connected drives
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 1828
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3896

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
MD5
94b4ad73963959e339923ddcabf6b331

SHA1
aa2c6af08dd5478d326c90ef2146c3ee2a7b55b2

SHA256
8945240c6d037d35d6124ac4b9815a8d74d785fa30c2c4b2fd54ed2fb68f58f4

SHA512
aefafb7d184e5564bdc65311e52619950f603fb89259de2af3b8f9fa05c346bf9e3f33b9cbe05a01389ef97642c7e37299ce8b9b4f3cb9f6d4e9a6877c537126

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
MD5
3208da0c038576623565b095fcea4ad1

SHA1
bc421f8eb4b9c6100aa444edece988c01dd63b26

SHA256
16ca708624c0f83871bbb8349e31fba20e5591f298ee91ddf08faf2919041f4b

SHA512
17fd810bdb400ce06167d6009a23cbdafdeb5eb0cb5c18456ec3a833546ad050429b003bdec753aa591d5b370cbb1290633abc1cc71f3ae29e81d58c56b8408c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
c6f27d5d1ee450d3400bf13e0804fce6

SHA1
2d0505f90eca6a49ca15b742aa5ef9ef01c7af41

SHA256
2c01ba329cfb39b6141b3c98d662ba24eb458e051fb7de79f975e681e8b4327a

SHA512
75687ddffd7021a033d19049f0cc05bbccd97a1433c06738a04590ed660996f669838514fe9f3b7c4b2eb494cf8a594f54bab1446cc915da4a042c3a327adc3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
MD5
75edaf186beb9ab50c08479a748e2530

SHA1
787e0348c115853b7240f3b5d8a3a3cf0e724409

SHA256
1e41480957c95f1cf0ab93d9457ffbc08b3b75fcc6117ec81ff5c264017310c3

SHA512
88f1ea7d5daeb9068f7dbe44212e86579c62416ca4a2f1c2bac0ce2188c7701fdca2724cae714013b18e6b01af8ceb3108d7a08fc95af0061aa37528fa6b7172

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
MD5
2375451c9ed125d31eb469a005f15b35

SHA1
01cc7df713d15fcdc76220423ee75c5fca4cabdd

SHA256
0e690561c946e6cbff574fa0c43b0cd1fb064b5324d2b747b21c26da23dc5b80

SHA512
67fc29232eb21156ba263976f7a727f7ca7628403447b6dad821d616ff03363943e2ec7bcef12d2c234ea7e8244b35568392922bac36cbfecb0f331842405571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
MD5
7c4c23cf2f429cc77385cf5c3e6e147e

SHA1
0b73769c9fd7ca4e7a343b4e1edac3cdafee0814

SHA256
b51ffd672a0acacbb5747c0878835c4deba4e19ae13845be73e6845f258c5b11

SHA512
952ee043a148ca3e6d301317c0355b08776d051e81b61ad7f09ed34d75ee6fbdfdc494763db1f96487c8a7bb27f453ccf7a3cc59ebef6fff5ae47663911a6ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JGAO043J\7KJIURMQ.htm
MD5
6b17a59cec1a7783febae9aa55c56556

SHA1
01d4581e2b3a6348679147a915a0b22b2a66643a

SHA256
66987b14b90d41632be98836f9601b12e7f329ffab05595887889c9c5716fbeb

SHA512
3337efd12b9c06b7768eb928a78caae243b75257c5aabe7a49e908a2f735af55f7257a40bd2330dc13865ead18ed805b54a6c5105740fdcbbaccacf7997bcbc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S7PGJ114\0SWQCV8D.htm
MD5
b1cd7c031debba3a5c77b39b6791c1a7

SHA1
e5d91e14e9c685b06f00e550d9e189deb2075f76

SHA256
57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

SHA512
d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
MD5
ada523db2c2418fa37398c41b370c125

SHA1
7c2c197b14447cbf4bd0d040a36493ec1d9d8bc7

SHA256
66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af

SHA512
849e06f1308ef00d1cf5ac71d9deb5699bae0e3985bca11525d3a95879325d1c11ad30f7c1bf80ef51ccc71032ab793ac2bef305c051391c9cefd91253621343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
MD5
ada523db2c2418fa37398c41b370c125

SHA1
7c2c197b14447cbf4bd0d040a36493ec1d9d8bc7

SHA256
66fc6e71a9c6be1f604c4a2d0650914f67c45d894fd1f76913e463079d47a8af

SHA512
849e06f1308ef00d1cf5ac71d9deb5699bae0e3985bca11525d3a95879325d1c11ad30f7c1bf80ef51ccc71032ab793ac2bef305c051391c9cefd91253621343

Download Submit
memory/2208-21-0x0000000000000000-mapping.dmp

Download
memory/2208-20-0x0000000000000000-mapping.dmp

Download
memory/2208-24-0x0000000000000000-mapping.dmp

Download
memory/2208-15-0x0000000000000000-mapping.dmp

Download
memory/2208-14-0x0000000000000000-mapping.dmp

Download
memory/2208-16-0x0000000000000000-mapping.dmp

Download
memory/2208-18-0x0000000000000000-mapping.dmp

Download
memory/2208-17-0x0000000000000000-mapping.dmp

Download
memory/2208-0-0x0000000000000000-mapping.dmp

Download
memory/2208-26-0x0000000000000000-mapping.dmp

Download
memory/2208-19-0x0000000000000000-mapping.dmp

Download
memory/2208-22-0x0000000000000000-mapping.dmp

Download
memory/2208-23-0x0000000000000000-mapping.dmp

Download
memory/2208-25-0x0000000000000000-mapping.dmp

Download
memory/3896-11-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/3896-12-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/3896-27-0x0000000005740000-0x0000000005741000-memory.dmp

Filesize
4KB

Download