73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6

General

Target

73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
Size

140KB
MD5

7b65e63c36e781c71391a0484a9c9fc6
SHA1

77b2d53fe45b72b3bf8a23ea3f48a66523e77fba
SHA256

73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6
SHA512

748ebc43558ee47def86b494663d05e89748399b0cf4e5bad4485ae029eb60515f457e099d1ab2e33f874e1f04d4ec2a9e9aec41c909fcb110776a6c86179031
SSDEEP

1536:uZ7RvfEJgmC3YsEQnXfAjHDee3GjZfICQcOFGPJ5afsdNn5vVkkQQ7:2FNFveee3GjB9OFy5i+5Nkkr

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1568	wkssvr.exe
964	wkssvr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSN = "C:\\Windows\\wkssvr.exe"	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1468 set thread context of 1548	1468	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	28
PID 1568 set thread context of 964	1568	wkssvr.exe	30

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\wkssvr.exe	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
File opened for modification	C:\Windows\wkssvr.exe	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
File opened for modification	C:\Windows\wkssvr.exe	wkssvr.exe
File created	C:\Windows\wkssvr.exe	wkssvr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1468	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
1568	wkssvr.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1548	1468	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	28
PID 1468 wrote to memory of 1548	1468	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	28
PID 1468 wrote to memory of 1548	1468	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	28
PID 1468 wrote to memory of 1548	1468	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	28
PID 1468 wrote to memory of 1548	1468	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	28
PID 1468 wrote to memory of 1548	1468	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	28
PID 1468 wrote to memory of 1548	1468	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	28
PID 1468 wrote to memory of 1548	1468	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	28
PID 1468 wrote to memory of 1548	1468	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	28
PID 1548 wrote to memory of 1568	1548	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	29
PID 1548 wrote to memory of 1568	1548	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	29
PID 1548 wrote to memory of 1568	1548	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	29
PID 1548 wrote to memory of 1568	1548	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	29
PID 1568 wrote to memory of 964	1568	wkssvr.exe	30
PID 1568 wrote to memory of 964	1568	wkssvr.exe	30
PID 1568 wrote to memory of 964	1568	wkssvr.exe	30
PID 1568 wrote to memory of 964	1568	wkssvr.exe	30
PID 1568 wrote to memory of 964	1568	wkssvr.exe	30
PID 1568 wrote to memory of 964	1568	wkssvr.exe	30
PID 1568 wrote to memory of 964	1568	wkssvr.exe	30
PID 1568 wrote to memory of 964	1568	wkssvr.exe	30
PID 1568 wrote to memory of 964	1568	wkssvr.exe	30

C:\Users\Admin\AppData\Local\Temp\73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
"C:\Users\Admin\AppData\Local\Temp\73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
  "C:\Users\Admin\AppData\Local\Temp\73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\wkssvr.exe
    "C:\Windows\wkssvr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Windows\wkssvr.exe
      "C:\Windows\wkssvr.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\wkssvr.exe

Filesize
140KB

MD5
7b65e63c36e781c71391a0484a9c9fc6

SHA1
77b2d53fe45b72b3bf8a23ea3f48a66523e77fba

SHA256
73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6

SHA512
748ebc43558ee47def86b494663d05e89748399b0cf4e5bad4485ae029eb60515f457e099d1ab2e33f874e1f04d4ec2a9e9aec41c909fcb110776a6c86179031

Download Submit
C:\Windows\wkssvr.exe

Filesize
140KB

MD5
7b65e63c36e781c71391a0484a9c9fc6

SHA1
77b2d53fe45b72b3bf8a23ea3f48a66523e77fba

SHA256
73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6

SHA512
748ebc43558ee47def86b494663d05e89748399b0cf4e5bad4485ae029eb60515f457e099d1ab2e33f874e1f04d4ec2a9e9aec41c909fcb110776a6c86179031

Download Submit
C:\Windows\wkssvr.exe

Filesize
140KB

MD5
7b65e63c36e781c71391a0484a9c9fc6

SHA1
77b2d53fe45b72b3bf8a23ea3f48a66523e77fba

SHA256
73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6

SHA512
748ebc43558ee47def86b494663d05e89748399b0cf4e5bad4485ae029eb60515f457e099d1ab2e33f874e1f04d4ec2a9e9aec41c909fcb110776a6c86179031

Download Submit
memory/964-86-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1468-66-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1548-61-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1548-64-0x0000000075211000-0x0000000075213000-memory.dmp

Filesize
8KB

Download
memory/1548-65-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1548-56-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1548-60-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1548-82-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1548-85-0x00000000003D0000-0x00000000003F3000-memory.dmp

Filesize
140KB

Download
memory/1548-59-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1548-57-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1568-81-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing