Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-07-2022 10:47
Static task
static1
Behavioral task
behavioral1
Sample
45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe
Resource
win10v2004-20220414-en
General
-
Target
45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe
-
Size
1.9MB
-
MD5
a11109d3316d966a57e8b50cd7ed12dc
-
SHA1
2cc9f2d62662abf99d83fad61d02452d9a4c764b
-
SHA256
45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82
-
SHA512
ff325b04a7039212135d988f01176c8d556f34a7182fcfd154eb123e4f11367440c7af7cca56d49ba9c175a1c77abf7e83e84cb2f4a3865fe02e0fa9087b546d
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exeservices.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe" services.exe -
Processes:
resource yara_rule C:\Windows\SysWOW64\winkey.dll aspack_v212_v242 -
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exeservices.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe" services.exe -
Executes dropped EXE 2 IoCs
Processes:
fservice.exeservices.exepid process 2328 fservice.exe 4584 services.exe -
Modifies Installed Components in the registry 2 TTPs 5 IoCs
Processes:
45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exeservices.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y} 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\ services.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe" services.exe -
Loads dropped DLL 5 IoCs
Processes:
services.exefservice.exe45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exepid process 4584 services.exe 4584 services.exe 4584 services.exe 2328 fservice.exe 4644 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exeservices.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ services.exe -
Drops file in System32 directory 7 IoCs
Processes:
45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exefservice.exeservices.exedescription ioc process File created C:\Windows\SysWOW64\fservice.exe 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe File opened for modification C:\Windows\SysWOW64\fservice.exe 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe File created C:\Windows\SysWOW64\fservice.exe fservice.exe File opened for modification C:\Windows\SysWOW64\fservice.exe fservice.exe File created C:\Windows\SysWOW64\winkey.dll services.exe File created C:\Windows\SysWOW64\reginv.dll services.exe File created C:\Windows\SysWOW64\fservice.exe services.exe -
Drops file in Windows directory 7 IoCs
Processes:
45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exefservice.exeservices.exedescription ioc process File opened for modification C:\Windows\system\sservice.exe 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe File created C:\Windows\services.exe fservice.exe File opened for modification C:\Windows\services.exe fservice.exe File created C:\Windows\system\sservice.exe fservice.exe File opened for modification C:\Windows\system\sservice.exe fservice.exe File created C:\Windows\system\sservice.exe services.exe File created C:\Windows\system\sservice.exe 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
services.exepid process 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe 4584 services.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
services.exepid process 4584 services.exe 4584 services.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exefservice.exeservices.exeNET.exedescription pid process target process PID 4644 wrote to memory of 2328 4644 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe fservice.exe PID 4644 wrote to memory of 2328 4644 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe fservice.exe PID 4644 wrote to memory of 2328 4644 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe fservice.exe PID 2328 wrote to memory of 4584 2328 fservice.exe services.exe PID 2328 wrote to memory of 4584 2328 fservice.exe services.exe PID 2328 wrote to memory of 4584 2328 fservice.exe services.exe PID 4584 wrote to memory of 4112 4584 services.exe NET.exe PID 4584 wrote to memory of 4112 4584 services.exe NET.exe PID 4584 wrote to memory of 4112 4584 services.exe NET.exe PID 4112 wrote to memory of 4924 4112 NET.exe net1.exe PID 4112 wrote to memory of 4924 4112 NET.exe net1.exe PID 4112 wrote to memory of 4924 4112 NET.exe net1.exe PID 4644 wrote to memory of 2012 4644 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe cmd.exe PID 4644 wrote to memory of 2012 4644 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe cmd.exe PID 4644 wrote to memory of 2012 4644 45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe"C:\Users\Admin\AppData\Local\Temp\45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\fservice.exeC:\Windows\system32\fservice.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\services.exeC:\Windows\services.exe -XP3⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\NET.exeNET STOP navapsvc4⤵
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 STOP navapsvc5⤵PID:4924
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe.bat2⤵PID:2012
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\45cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82.exe.batFilesize
133B
MD562b57691cd1ca29732eb2a2811b4897b
SHA18f5957e51911da5d238cb5842ce683c9c443f978
SHA256720b0b99c9b7ed7e919c240c6fa9d56c7fa8c1aeba167942bf82798a49d696f6
SHA512d4dc23459f5d011b2c30da48e7c401b4993ecbe734ae9659250caad39d5a88591a4886b108e131682f0fbf4030a7793a453b1821f59942765fefaa93ec02e126
-
C:\Windows\SysWOW64\fservice.exeFilesize
1.9MB
MD5a11109d3316d966a57e8b50cd7ed12dc
SHA12cc9f2d62662abf99d83fad61d02452d9a4c764b
SHA25645cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82
SHA512ff325b04a7039212135d988f01176c8d556f34a7182fcfd154eb123e4f11367440c7af7cca56d49ba9c175a1c77abf7e83e84cb2f4a3865fe02e0fa9087b546d
-
C:\Windows\SysWOW64\fservice.exeFilesize
1.9MB
MD5a11109d3316d966a57e8b50cd7ed12dc
SHA12cc9f2d62662abf99d83fad61d02452d9a4c764b
SHA25645cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82
SHA512ff325b04a7039212135d988f01176c8d556f34a7182fcfd154eb123e4f11367440c7af7cca56d49ba9c175a1c77abf7e83e84cb2f4a3865fe02e0fa9087b546d
-
C:\Windows\SysWOW64\reginv.dllFilesize
36KB
MD5562e0d01d6571fa2251a1e9f54c6cc69
SHA183677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea
-
C:\Windows\SysWOW64\reginv.dllFilesize
36KB
MD5562e0d01d6571fa2251a1e9f54c6cc69
SHA183677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea
-
C:\Windows\SysWOW64\reginv.dllFilesize
36KB
MD5562e0d01d6571fa2251a1e9f54c6cc69
SHA183677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea
-
C:\Windows\SysWOW64\reginv.dllFilesize
36KB
MD5562e0d01d6571fa2251a1e9f54c6cc69
SHA183677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea
-
C:\Windows\SysWOW64\reginv.dllFilesize
36KB
MD5562e0d01d6571fa2251a1e9f54c6cc69
SHA183677ad3bc630aa6327253c7b3deffbd4a8ce905
SHA256c5b1d800c86d550c0b68c57c0d9911c1dd21df9e5e37e9e7bc032b5e66fdebe6
SHA512166e132432eca24061f7e7d0c58c0b286e971ae2bc50f7c890b7707dd5dede19fcd83a5f79b6fd3f93dd691e07ad9bc1bd05fe82ccaade1610282188571585ea
-
C:\Windows\SysWOW64\winkey.dllFilesize
13KB
MD5b4c72da9fd1a0dcb0698b7da97daa0cd
SHA1b25a79e8ea4c723c58caab83aed6ea48de7ed759
SHA25645d266269634ba2de70f179a26d7224111e677e66b38dff2802851b71ce4458f
SHA512f5f184416c5381d275bc093c9275e9fdb35c58e2c401d188aef097950013de6e43269da5d4dd5e7baea34735bd7de664d15fe487b2292fd66926c9845b0cd066
-
C:\Windows\services.exeFilesize
1.9MB
MD5a11109d3316d966a57e8b50cd7ed12dc
SHA12cc9f2d62662abf99d83fad61d02452d9a4c764b
SHA25645cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82
SHA512ff325b04a7039212135d988f01176c8d556f34a7182fcfd154eb123e4f11367440c7af7cca56d49ba9c175a1c77abf7e83e84cb2f4a3865fe02e0fa9087b546d
-
C:\Windows\services.exeFilesize
1.9MB
MD5a11109d3316d966a57e8b50cd7ed12dc
SHA12cc9f2d62662abf99d83fad61d02452d9a4c764b
SHA25645cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82
SHA512ff325b04a7039212135d988f01176c8d556f34a7182fcfd154eb123e4f11367440c7af7cca56d49ba9c175a1c77abf7e83e84cb2f4a3865fe02e0fa9087b546d
-
C:\Windows\system\sservice.exeFilesize
1.9MB
MD5a11109d3316d966a57e8b50cd7ed12dc
SHA12cc9f2d62662abf99d83fad61d02452d9a4c764b
SHA25645cc84a95b2d3de60782bcc9e3b203ba2f0ac36f9ed1faeb2e675670e4447c82
SHA512ff325b04a7039212135d988f01176c8d556f34a7182fcfd154eb123e4f11367440c7af7cca56d49ba9c175a1c77abf7e83e84cb2f4a3865fe02e0fa9087b546d
-
memory/2012-147-0x0000000000000000-mapping.dmp
-
memory/2328-130-0x0000000000000000-mapping.dmp
-
memory/4112-139-0x0000000000000000-mapping.dmp
-
memory/4584-134-0x0000000000000000-mapping.dmp
-
memory/4584-143-0x0000000002D81000-0x0000000002D85000-memory.dmpFilesize
16KB
-
memory/4584-138-0x0000000010000000-0x000000001000B000-memory.dmpFilesize
44KB
-
memory/4924-140-0x0000000000000000-mapping.dmp