32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2

General

Target

32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe
Size

31KB
MD5

1d1f570f8864f03e9b204123262fc88f
SHA1

0474413b0c075c6c36c5def91234d13b8c4167d2
SHA256

32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2
SHA512

dfa3e266822115fc324f2e0750199f8516cf9d8a43a45c2f582ca54ad0dd3c21f58cb8b3516aee189703d506854eb9b521c1371eaf32f60d91cbcc7a90078b86
SSDEEP

768:oIqeh0FpzQkr4CdjQ1N3LhGjD2/HH0Fiex:oz3FpzR6rbhGaH+F

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0"	vvpvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	vvpvs.exe

Executes dropped EXE 1 IoCs

pid	Process
1232	vvpvs.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Avt-Net\Parameters\ServiceDll = "%SystemRoot%\\system32\\svcnet32.dll"	vvpvs.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Avt-Net\ImagePath = "%SystemRoot%\\system32\\svchost -k Avt-Net"	vvpvs.exe

Deletes itself 1 IoCs

pid	Process
1492	cmd.exe

Loads dropped DLL 3 IoCs

pid	Process
852	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe
852	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe
1020	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svcnet32.dll	vvpvs.exe
File opened for modification	C:\Windows\SysWOW64\svcnet32.dll	vvpvs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\vvpvs.exe	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe
File opened for modification	C:\Program Files (x86)\vvpvs.exe	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe
File opened for modification	C:\Program Files (x86)\syslass.cpl	vvpvs.exe
File created	C:\Program Files (x86)\syslass.cpl	vvpvs.exe
File opened for modification	C:\Program Files (x86)\vvpvs.exe	vvpvs.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\WpadDecisionTime = 0018662c72ccd801	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1\WpadDecisionTime = 0018662c72ccd801	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\WpadNetworkName = "Network 2"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0003000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C321BB3F-5A05-4D2C-8AF4-0D288A94FFFE}\66-33-80-44-1a-b1	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\66-33-80-44-1a-b1\WpadDecision = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0"	vvpvs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0"	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	852	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1020	svchost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 1232	852	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe	27
PID 852 wrote to memory of 1232	852	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe	27
PID 852 wrote to memory of 1232	852	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe	27
PID 852 wrote to memory of 1232	852	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe	27
PID 852 wrote to memory of 1492	852	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe	29
PID 852 wrote to memory of 1492	852	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe	29
PID 852 wrote to memory of 1492	852	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe	29
PID 852 wrote to memory of 1492	852	32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe	29

C:\Users\Admin\AppData\Local\Temp\32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe
"C:\Users\Admin\AppData\Local\Temp\32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852
- C:\Program Files (x86)\vvpvs.exe
  "C:\Program Files (x86)\vvpvs.exe"
  2⤵
  - Modifies system executable filetype association
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Sets DLL path for service in the registry
  - Sets service image path in registry
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies registry class
  PID:1232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\32EE8D~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1492

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost -k Avt-Net
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1020

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\vvpvs.exe

Filesize
31KB

MD5
1d1f570f8864f03e9b204123262fc88f

SHA1
0474413b0c075c6c36c5def91234d13b8c4167d2

SHA256
32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2

SHA512
dfa3e266822115fc324f2e0750199f8516cf9d8a43a45c2f582ca54ad0dd3c21f58cb8b3516aee189703d506854eb9b521c1371eaf32f60d91cbcc7a90078b86

Download Submit
C:\Program Files (x86)\vvpvs.exe

Filesize
31KB

MD5
1d1f570f8864f03e9b204123262fc88f

SHA1
0474413b0c075c6c36c5def91234d13b8c4167d2

SHA256
32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2

SHA512
dfa3e266822115fc324f2e0750199f8516cf9d8a43a45c2f582ca54ad0dd3c21f58cb8b3516aee189703d506854eb9b521c1371eaf32f60d91cbcc7a90078b86

Download Submit
\??\c:\windows\SysWOW64\svcnet32.dll

Filesize
14KB

MD5
7b56a5a2da99cda4c457913c0aa91fd2

SHA1
fa2b7ef4e22274d122b7127bd3bf15b401455372

SHA256
204c473348b18c83e86d2ad78675087242d852e7d3b6e9212fb289cb5b2c3eea

SHA512
2885fbd377cc8e278130b79498dbfa4fa6040a4f6b6c59f0b07362b31742e3a2ce06ccca8ba05b93f38b02df6ab8ea9d7014ca3275de1311ad610adec4b75d07

Download Submit
\Program Files (x86)\vvpvs.exe

Filesize
31KB

MD5
1d1f570f8864f03e9b204123262fc88f

SHA1
0474413b0c075c6c36c5def91234d13b8c4167d2

SHA256
32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2

SHA512
dfa3e266822115fc324f2e0750199f8516cf9d8a43a45c2f582ca54ad0dd3c21f58cb8b3516aee189703d506854eb9b521c1371eaf32f60d91cbcc7a90078b86

Download Submit
\Program Files (x86)\vvpvs.exe

Filesize
31KB

MD5
1d1f570f8864f03e9b204123262fc88f

SHA1
0474413b0c075c6c36c5def91234d13b8c4167d2

SHA256
32ee8d87c7983c2c8dde9d73b4dc8c8bdd0636fdf8e7d9432994bb7479ab20f2

SHA512
dfa3e266822115fc324f2e0750199f8516cf9d8a43a45c2f582ca54ad0dd3c21f58cb8b3516aee189703d506854eb9b521c1371eaf32f60d91cbcc7a90078b86

Download Submit
\Windows\SysWOW64\svcnet32.dll

Filesize
14KB

MD5
7b56a5a2da99cda4c457913c0aa91fd2

SHA1
fa2b7ef4e22274d122b7127bd3bf15b401455372

SHA256
204c473348b18c83e86d2ad78675087242d852e7d3b6e9212fb289cb5b2c3eea

SHA512
2885fbd377cc8e278130b79498dbfa4fa6040a4f6b6c59f0b07362b31742e3a2ce06ccca8ba05b93f38b02df6ab8ea9d7014ca3275de1311ad610adec4b75d07

Download Submit
memory/852-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download
memory/852-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/852-62-0x0000000000230000-0x000000000024E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads