0cd84bfd6c8c5f61e644286675ece0013aafea6a538f899afc544bcbc0c00f75

General

Target
473b99ecfc3b75620f6201898e1d8f74.exe
Size 473KB
Sample201109-avcdqa5kls
SHA256 0cd84bfd6c8c5f61e644286675ece0013aafea6a538f899afc544bcbc0c00f75
MD5 473b99ecfc3b75620f6201898e1d8f74
SHA1 d30e8402cfdd0c2bb67c9c27fbba685682861818
SHA512 45b4ef4bf7fd28543ee1f1ac738fe66daebb1cffd45f4cd357d9e6a86419da184764ef66adb854dcb985a5b5259d2de1a6c3fa67f3e3c52e8582f2fe538dbba8
MD5 SHA1 SHA512

Score

10^/10

discovery persistence

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3020	2736	cmd.exe	80

ServiceHost packer 15 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/4048-30-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-29-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-31-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-32-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-33-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-34-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-35-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-36-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-38-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-37-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-39-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-41-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-40-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-42-0x0000000000000000-mapping.dmp	servicehost
behavioral2/memory/4048-43-0x0000000000000000-mapping.dmp	servicehost

Executes dropped EXE 4 IoCs

pid	Process
2552	wotsuper.exe
748	1.exe
4048	2.exe
2576	spoolsvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\VersionRecover = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\spoolsvc.exe"	spoolsvc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe	473b99ecfc3b75620f6201898e1d8f74.exe
File opened for modification	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.exe	473b99ecfc3b75620f6201898e1d8f74.exe
File created	C:\Program Files (x86)\wotsuper\wotsuper\Uninstall.ini	473b99ecfc3b75620f6201898e1d8f74.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wotsuper.reg	473b99ecfc3b75620f6201898e1d8f74.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
944	4048	WerFault.exe	79

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2964	regedit.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe
944	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4048	2.exe
Token: SeRestorePrivilege	944	WerFault.exe
Token: SeBackupPrivilege	944	WerFault.exe
Token: SeDebugPrivilege	944	WerFault.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1544	efsui.exe
1544	efsui.exe
1544	efsui.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1544	efsui.exe
1544	efsui.exe
1544	efsui.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 2552	3408	473b99ecfc3b75620f6201898e1d8f74.exe	76
PID 3408 wrote to memory of 2552	3408	473b99ecfc3b75620f6201898e1d8f74.exe	76
PID 3408 wrote to memory of 2552	3408	473b99ecfc3b75620f6201898e1d8f74.exe	76
PID 3408 wrote to memory of 2964	3408	473b99ecfc3b75620f6201898e1d8f74.exe	77
PID 3408 wrote to memory of 2964	3408	473b99ecfc3b75620f6201898e1d8f74.exe	77
PID 3408 wrote to memory of 2964	3408	473b99ecfc3b75620f6201898e1d8f74.exe	77
PID 2552 wrote to memory of 748	2552	wotsuper.exe	78
PID 2552 wrote to memory of 748	2552	wotsuper.exe	78
PID 2552 wrote to memory of 748	2552	wotsuper.exe	78
PID 2552 wrote to memory of 4048	2552	wotsuper.exe	79
PID 2552 wrote to memory of 4048	2552	wotsuper.exe	79
PID 2552 wrote to memory of 4048	2552	wotsuper.exe	79
PID 3020 wrote to memory of 216	3020	cmd.exe	89
PID 3020 wrote to memory of 216	3020	cmd.exe	89
PID 3020 wrote to memory of 2576	3020	cmd.exe	91
PID 3020 wrote to memory of 2576	3020	cmd.exe	91
PID 3020 wrote to memory of 2576	3020	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\473b99ecfc3b75620f6201898e1d8f74.exe
"C:\Users\Admin\AppData\Local\Temp\473b99ecfc3b75620f6201898e1d8f74.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe
  "C:\Program Files (x86)\wotsuper\wotsuper\wotsuper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\1.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\1.exe"
    3⤵
    - Executes dropped EXE
    PID:748
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 1848
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:944
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" \s C:\Windows\wotsuper.reg
  2⤵
  - Runs .reg file with regedit
  PID:2964

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
1⤵
PID:3156

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:3816

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1000

C:\Windows\system32\efsui.exe
efsui.exe /efs /keybackup
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1544

C:\Windows\system32\cmd.exe
cmd /c choice /C Y /N /D Y /T 3 & del "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\1.exe" & C:\Users\Admin\AppData\Local\Microsoft\spoolsvc.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\system32\choice.exe
  choice /C Y /N /D Y /T 3
  2⤵
  PID:216
- C:\Users\Admin\AppData\Local\Microsoft\spoolsvc.exe
  C:\Users\Admin\AppData\Local\Microsoft\spoolsvc.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/748-13-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/748-16-0x0000000005030000-0x0000000005031000-memory.dmp

Download

memory/748-10-0x00000000720D0000-0x00000000727BE000-memory.dmp

Download

memory/944-28-0x00000000046C0000-0x00000000046C1000-memory.dmp

Download

memory/944-44-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/2576-23-0x00000000720D0000-0x00000000727BE000-memory.dmp

Download

memory/4048-12-0x0000000000550000-0x0000000000551000-memory.dmp

Download

memory/4048-11-0x00000000720D0000-0x00000000727BE000-memory.dmp

Download

memory/4048-17-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads