ebe588c49f9735f4efbed599b492410703a4a49ec347c6c54e0d0d8a6532dc83

General

Target
baf481ef2e6897d7ac462dbab1a0c5f7.exe
Size 1.2MB
Sample220309-spl7hacehq
SHA256 ebe588c49f9735f4efbed599b492410703a4a49ec347c6c54e0d0d8a6532dc83
MD5 baf481ef2e6897d7ac462dbab1a0c5f7
SHA1 39e2eb47062fa01ff57b93340040f5168a9f94c9
SHA512 bd43cb2200fa3a0f21bcf0c67cfc75db6144f494166faff6cc4a89b8daccac74716d8e0cf994d646bf0453dea0b2121e2a5ab6a8717f340971522e269e1fea4b
MD5 SHA1 SHA512

Score

8^/10

persistence upx

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3452-130-0x0000000000400000-0x0000000000611000-memory.dmp	upx
behavioral2/memory/3452-132-0x0000000000400000-0x0000000000611000-memory.dmp	upx
behavioral2/memory/3452-133-0x0000000000400000-0x0000000000611000-memory.dmp	upx
behavioral2/memory/3452-134-0x0000000000400000-0x0000000000611000-memory.dmp	upx
behavioral2/memory/968-138-0x00000000035F0000-0x00000000035FB000-memory.dmp	upx
behavioral2/memory/968-139-0x00000000035F0000-0x00000000035FB000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
968	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Delete00.bat	baf481ef2e6897d7ac462dbab1a0c5f7.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2544 set thread context of 3452	2544	baf481ef2e6897d7ac462dbab1a0c5f7.exe	57

Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3280	PING.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3452	baf481ef2e6897d7ac462dbab1a0c5f7.exe
3452	baf481ef2e6897d7ac462dbab1a0c5f7.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe
968	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	baf481ef2e6897d7ac462dbab1a0c5f7.exe
Token: SeDebugPrivilege	968	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 3452	2544	baf481ef2e6897d7ac462dbab1a0c5f7.exe	57
PID 2544 wrote to memory of 3452	2544	baf481ef2e6897d7ac462dbab1a0c5f7.exe	57
PID 2544 wrote to memory of 3452	2544	baf481ef2e6897d7ac462dbab1a0c5f7.exe	57
PID 2544 wrote to memory of 3452	2544	baf481ef2e6897d7ac462dbab1a0c5f7.exe	57
PID 2544 wrote to memory of 3452	2544	baf481ef2e6897d7ac462dbab1a0c5f7.exe	57
PID 3452 wrote to memory of 3992	3452	baf481ef2e6897d7ac462dbab1a0c5f7.exe	58
PID 3452 wrote to memory of 3992	3452	baf481ef2e6897d7ac462dbab1a0c5f7.exe	58
PID 3452 wrote to memory of 3992	3452	baf481ef2e6897d7ac462dbab1a0c5f7.exe	58
PID 3452 wrote to memory of 3500	3452	baf481ef2e6897d7ac462dbab1a0c5f7.exe	61
PID 3452 wrote to memory of 3500	3452	baf481ef2e6897d7ac462dbab1a0c5f7.exe	61
PID 3452 wrote to memory of 3500	3452	baf481ef2e6897d7ac462dbab1a0c5f7.exe	61
PID 3500 wrote to memory of 3280	3500	cmd.exe	65
PID 3500 wrote to memory of 3280	3500	cmd.exe	65
PID 3500 wrote to memory of 3280	3500	cmd.exe	65

C:\Users\Admin\AppData\Local\Temp\baf481ef2e6897d7ac462dbab1a0c5f7.exe
"C:\Users\Admin\AppData\Local\Temp\baf481ef2e6897d7ac462dbab1a0c5f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\baf481ef2e6897d7ac462dbab1a0c5f7.exe
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\SysWOW64\sc.exe
    sc failure SQL Server Reporting Services (MSSQLSERVSER) reset= 86400 actions= restart/1000
    3⤵
    PID:3992
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\System32\\Delete00.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3500
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1
      4⤵
      Runs ping.exe
      PID:3280

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-138-0x00000000035F0000-0x00000000035FB000-memory.dmp

Download

memory/968-139-0x00000000035F0000-0x00000000035FB000-memory.dmp

Download

memory/3452-130-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3452-132-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3452-133-0x0000000000400000-0x0000000000611000-memory.dmp

Download

memory/3452-134-0x0000000000400000-0x0000000000611000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads