5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace

General

Target

5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe
Size

60KB
MD5

ff672b6d51815ef9c86e163bfd23f1a5
SHA1

e4a08257258bc59d67992d762d60ea34f08a6b9d
SHA256

5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace
SHA512

d957e4e27e6eb10de02d032fbba52918dc9aa67c350b593463e9756fc8c91208a2065d35f13585b60414df5e19ed5f68aadbcb69630fc02b9a0201761064fd57

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Drops file in Program Files directory 1 IoCs

Processes:

5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe

description ioc process

File created C:\Program Files (x86)\SysNt Corp\settings.ini 5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe

description	ioc	process
File created	C:\Program Files (x86)\SysNt Corp\settings.ini	5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

Processes:

explorer.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: 33	1676	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1676	AUDIODG.EXE
Token: 33	1676	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1676	AUDIODG.EXE
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe
Token: SeShutdownPrivilege	1088	explorer.exe

Suspicious use of FindShellTrayWindow 24 IoCs

Processes:

explorer.exe

pid	process
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

explorer.exe

pid	process
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe
1088	explorer.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exerunas.exeexplorer.exe

description	pid	process	target process
PID 1960 wrote to memory of 532	1960	5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe	runas.exe
PID 1960 wrote to memory of 532	1960	5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe	runas.exe
PID 1960 wrote to memory of 532	1960	5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe	runas.exe
PID 1960 wrote to memory of 532	1960	5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe	runas.exe
PID 532 wrote to memory of 1088	532	runas.exe	explorer.exe
PID 532 wrote to memory of 1088	532	runas.exe	explorer.exe
PID 532 wrote to memory of 1088	532	runas.exe	explorer.exe
PID 532 wrote to memory of 1088	532	runas.exe	explorer.exe
PID 1088 wrote to memory of 1332	1088	explorer.exe	ctfmon.exe
PID 1088 wrote to memory of 1332	1088	explorer.exe	ctfmon.exe
PID 1088 wrote to memory of 1332	1088	explorer.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe
"C:\Users\Admin\AppData\Local\Temp\5ec57873c7a4829f75472146d59eb8e44f926d9a0df8d4af51ca21c8cd80bace.exe"
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Windows\SysWOW64\runas.exe
  runas /trustlevel:0x20000 C:\Windows\explorer.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:532
- - C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    3⤵
    - Modifies Installed Components in the registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:1332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/532-55-0x0000000000000000-mapping.dmp

Download
memory/1088-57-0x0000000000000000-mapping.dmp

Download
memory/1088-58-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/1088-62-0x0000000002720000-0x0000000002730000-memory.dmp

Filesize
64KB

Download
memory/1332-59-0x0000000000000000-mapping.dmp

Download
memory/1960-54-0x0000000075DE1000-0x0000000075DE3000-memory.dmp

Filesize
8KB

Download
memory/1960-60-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download
memory/1960-61-0x00000000741D0000-0x000000007477B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads