ebe588c49f9735f4efbed599b492410703a4a49ec347c6c54e0d0d8a6532dc83

General

Target
baf481ef2e6897d7ac462dbab1a0c5f7.exe
Size 1.2MB
Sample220309-spl7hacehq
SHA256 ebe588c49f9735f4efbed599b492410703a4a49ec347c6c54e0d0d8a6532dc83
MD5 baf481ef2e6897d7ac462dbab1a0c5f7
SHA1 39e2eb47062fa01ff57b93340040f5168a9f94c9
SHA512 bd43cb2200fa3a0f21bcf0c67cfc75db6144f494166faff6cc4a89b8daccac74716d8e0cf994d646bf0453dea0b2121e2a5ab6a8717f340971522e269e1fea4b
MD5 SHA1 SHA512

Score

8^/10

persistence upx

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1076-57-0x0000000000400000-0x0000000000611000-memory.dmp	upx
behavioral1/memory/1076-60-0x0000000000400000-0x0000000000611000-memory.dmp	upx
behavioral1/memory/1076-61-0x0000000000400000-0x0000000000611000-memory.dmp	upx
behavioral1/memory/860-65-0x00000000000A0000-0x00000000000AB000-memory.dmp	upx
behavioral1/memory/860-67-0x00000000000A0000-0x00000000000AB000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
576	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
860	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Delete00.bat	baf481ef2e6897d7ac462dbab1a0c5f7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 960 set thread context of 1076	960	baf481ef2e6897d7ac462dbab1a0c5f7.exe	27

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1808	PING.EXE

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1076	baf481ef2e6897d7ac462dbab1a0c5f7.exe
860	svchost.exe
860	svchost.exe
860	svchost.exe
860	svchost.exe
860	svchost.exe
860	svchost.exe
860	svchost.exe
860	svchost.exe
860	svchost.exe
860	svchost.exe
860	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1076	baf481ef2e6897d7ac462dbab1a0c5f7.exe
Token: SeDebugPrivilege	860	svchost.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 1076	960	baf481ef2e6897d7ac462dbab1a0c5f7.exe	27
PID 960 wrote to memory of 1076	960	baf481ef2e6897d7ac462dbab1a0c5f7.exe	27
PID 960 wrote to memory of 1076	960	baf481ef2e6897d7ac462dbab1a0c5f7.exe	27
PID 960 wrote to memory of 1076	960	baf481ef2e6897d7ac462dbab1a0c5f7.exe	27
PID 960 wrote to memory of 1076	960	baf481ef2e6897d7ac462dbab1a0c5f7.exe	27
PID 960 wrote to memory of 1076	960	baf481ef2e6897d7ac462dbab1a0c5f7.exe	27
PID 960 wrote to memory of 1076	960	baf481ef2e6897d7ac462dbab1a0c5f7.exe	27
PID 960 wrote to memory of 1076	960	baf481ef2e6897d7ac462dbab1a0c5f7.exe	27
PID 960 wrote to memory of 1076	960	baf481ef2e6897d7ac462dbab1a0c5f7.exe	27
PID 1076 wrote to memory of 1104	1076	baf481ef2e6897d7ac462dbab1a0c5f7.exe	28
PID 1076 wrote to memory of 1104	1076	baf481ef2e6897d7ac462dbab1a0c5f7.exe	28
PID 1076 wrote to memory of 1104	1076	baf481ef2e6897d7ac462dbab1a0c5f7.exe	28
PID 1076 wrote to memory of 1104	1076	baf481ef2e6897d7ac462dbab1a0c5f7.exe	28
PID 1076 wrote to memory of 576	1076	baf481ef2e6897d7ac462dbab1a0c5f7.exe	31
PID 1076 wrote to memory of 576	1076	baf481ef2e6897d7ac462dbab1a0c5f7.exe	31
PID 1076 wrote to memory of 576	1076	baf481ef2e6897d7ac462dbab1a0c5f7.exe	31
PID 1076 wrote to memory of 576	1076	baf481ef2e6897d7ac462dbab1a0c5f7.exe	31
PID 576 wrote to memory of 1808	576	cmd.exe	33
PID 576 wrote to memory of 1808	576	cmd.exe	33
PID 576 wrote to memory of 1808	576	cmd.exe	33
PID 576 wrote to memory of 1808	576	cmd.exe	33

C:\Users\Admin\AppData\Local\Temp\baf481ef2e6897d7ac462dbab1a0c5f7.exe
"C:\Users\Admin\AppData\Local\Temp\baf481ef2e6897d7ac462dbab1a0c5f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:960
- C:\Users\Admin\AppData\Local\Temp\baf481ef2e6897d7ac462dbab1a0c5f7.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc failure SQL Server Reporting Services (MSSQLSERVSER) reset= 86400 actions= restart/1000
    3⤵
    PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Windows\System32\\Delete00.bat
    3⤵
    - Deletes itself
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:1808

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-65-0x00000000000A0000-0x00000000000AB000-memory.dmp

Download

memory/860-67-0x00000000000A0000-0x00000000000AB000-memory.dmp

Download

memory/960-54-0x0000000075131000-0x0000000075133000-memory.dmp

Download

memory/1076-55-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/1076-57-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/1076-60-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/1076-61-0x0000000000400000-0x0000000000611000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads