73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6

General

Target

73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
Size

140KB
MD5

7b65e63c36e781c71391a0484a9c9fc6
SHA1

77b2d53fe45b72b3bf8a23ea3f48a66523e77fba
SHA256

73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6
SHA512

748ebc43558ee47def86b494663d05e89748399b0cf4e5bad4485ae029eb60515f457e099d1ab2e33f874e1f04d4ec2a9e9aec41c909fcb110776a6c86179031
SSDEEP

1536:uZ7RvfEJgmC3YsEQnXfAjHDee3GjZfICQcOFGPJ5afsdNn5vVkkQQ7:2FNFveee3GjB9OFy5i+5Nkkr

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5052	wkssvr.exe
4968	wkssvr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSN = "C:\\Windows\\wkssvr.exe"	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1532 set thread context of 808	1532	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	80
PID 5052 set thread context of 4968	5052	wkssvr.exe	82

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wkssvr.exe	wkssvr.exe
File created	C:\Windows\wkssvr.exe	wkssvr.exe
File created	C:\Windows\wkssvr.exe	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
File opened for modification	C:\Windows\wkssvr.exe	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1532	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
5052	wkssvr.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 808	1532	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	80
PID 1532 wrote to memory of 808	1532	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	80
PID 1532 wrote to memory of 808	1532	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	80
PID 1532 wrote to memory of 808	1532	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	80
PID 1532 wrote to memory of 808	1532	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	80
PID 1532 wrote to memory of 808	1532	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	80
PID 1532 wrote to memory of 808	1532	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	80
PID 1532 wrote to memory of 808	1532	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	80
PID 808 wrote to memory of 5052	808	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	81
PID 808 wrote to memory of 5052	808	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	81
PID 808 wrote to memory of 5052	808	73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe	81
PID 5052 wrote to memory of 4968	5052	wkssvr.exe	82
PID 5052 wrote to memory of 4968	5052	wkssvr.exe	82
PID 5052 wrote to memory of 4968	5052	wkssvr.exe	82
PID 5052 wrote to memory of 4968	5052	wkssvr.exe	82
PID 5052 wrote to memory of 4968	5052	wkssvr.exe	82
PID 5052 wrote to memory of 4968	5052	wkssvr.exe	82
PID 5052 wrote to memory of 4968	5052	wkssvr.exe	82
PID 5052 wrote to memory of 4968	5052	wkssvr.exe	82

C:\Users\Admin\AppData\Local\Temp\73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
"C:\Users\Admin\AppData\Local\Temp\73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe
  "C:\Users\Admin\AppData\Local\Temp\73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\wkssvr.exe
    "C:\Windows\wkssvr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Windows\wkssvr.exe
      "C:\Windows\wkssvr.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      PID:4968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\wkssvr.exe

Filesize
140KB

MD5
7b65e63c36e781c71391a0484a9c9fc6

SHA1
77b2d53fe45b72b3bf8a23ea3f48a66523e77fba

SHA256
73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6

SHA512
748ebc43558ee47def86b494663d05e89748399b0cf4e5bad4485ae029eb60515f457e099d1ab2e33f874e1f04d4ec2a9e9aec41c909fcb110776a6c86179031

Download Submit
C:\Windows\wkssvr.exe

Filesize
140KB

MD5
7b65e63c36e781c71391a0484a9c9fc6

SHA1
77b2d53fe45b72b3bf8a23ea3f48a66523e77fba

SHA256
73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6

SHA512
748ebc43558ee47def86b494663d05e89748399b0cf4e5bad4485ae029eb60515f457e099d1ab2e33f874e1f04d4ec2a9e9aec41c909fcb110776a6c86179031

Download Submit
C:\Windows\wkssvr.exe

Filesize
140KB

MD5
7b65e63c36e781c71391a0484a9c9fc6

SHA1
77b2d53fe45b72b3bf8a23ea3f48a66523e77fba

SHA256
73744fc10d250361bd416b8d57c1b18b035608adffd3fe6d9699c664bd1996d6

SHA512
748ebc43558ee47def86b494663d05e89748399b0cf4e5bad4485ae029eb60515f457e099d1ab2e33f874e1f04d4ec2a9e9aec41c909fcb110776a6c86179031

Download Submit
memory/808-136-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/808-138-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/808-140-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1532-139-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/1532-132-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/4968-153-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/5052-152-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/5052-146-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing