51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03

General

Target

51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Size

169KB
MD5

67fc5e1b6181932c69afcde68c0c9190
SHA1

67e72e83dd2d49782532800ed82a4d9531d0e013
SHA256

51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03
SHA512

062456412b8aff4e0b0e1b08fdaab9afb3d02c6904fbf13112c5cbf23cc4465ef25ddb5fb85690902d32d20e9079e2e0d42f81464962140be96ff1a2303de198
SSDEEP

3072:qqwYrSIP7lmQpT8i0gwWsu+Q9bvcDtI7sf2FDbfBX1Li+A+wqK4:DHWm7l/Ga9bB7lpX1aGK4

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1220	Explorer.EXE
464	services.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$bb8ab67ad8382496fd4eead6952e3208\\n."	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3845472200-3839195424-595303356-1000\\$bb8ab67ad8382496fd4eead6952e3208\\n."	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe

Deletes itself 1 IoCs

pid	Process
908	cmd.exe

Unexpected DNS network traffic destination 18 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.242.217.247
Destination IP	66.85.130.234
Destination IP	91.242.217.247
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	91.242.217.247
Destination IP	91.242.217.247
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	91.242.217.247
Destination IP	91.242.217.247
Destination IP	66.85.130.234
Destination IP	91.242.217.247
Destination IP	91.242.217.247
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	91.242.217.247

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1952 set thread context of 908	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe	28

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3845472200-3839195424-595303356-1000\\$bb8ab67ad8382496fd4eead6952e3208\\n."	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$bb8ab67ad8382496fd4eead6952e3208\\n."	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\clsid	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Token: SeDebugPrivilege	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Token: SeDebugPrivilege	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
Token: SeShutdownPrivilege	1220	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1952 wrote to memory of 1220	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe	12
PID 1952 wrote to memory of 1220	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe	12
PID 1952 wrote to memory of 464	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe	2
PID 1952 wrote to memory of 908	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe	28
PID 1952 wrote to memory of 908	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe	28
PID 1952 wrote to memory of 908	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe	28
PID 1952 wrote to memory of 908	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe	28
PID 1952 wrote to memory of 908	1952	51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe	28

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Executes dropped EXE
PID:464

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1220
- C:\Users\Admin\AppData\Local\Temp\51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe
  "C:\Users\Admin\AppData\Local\Temp\51528af05a27942ce0dccc6b19fa3b0a83c97d68b5335de52106a4acb6a7ec03.exe"
  2⤵
  - Registers COM server for autorun
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-18\$bb8ab67ad8382496fd4eead6952e3208\@

Filesize
2KB

MD5
00c71461daffcfd80ccbd40e551743eb

SHA1
e945f70488d85545a42b388a678fb01bdd84c465

SHA256
00197390004a37f6ceb4089e991079efbf180b51f0cd4e5d3bac6f1dbeaeba77

SHA512
e77288ed760a5b228538b6f46c4d17bde826540944fc9dff625d16d8d56c4b2ba366ee3baca0fb98c0352b072d4f28cd35366000b03c9d972118238a61619d38

Download Submit
C:\$Recycle.Bin\S-1-5-18\$bb8ab67ad8382496fd4eead6952e3208\n

Filesize
25KB

MD5
9e0cd37b6d0809cf7d5fa5b521538d0d

SHA1
411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2

SHA256
55d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2

SHA512
b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5

Download Submit
C:\$Recycle.Bin\S-1-5-21-3845472200-3839195424-595303356-1000\$bb8ab67ad8382496fd4eead6952e3208\n

Filesize
25KB

MD5
9e0cd37b6d0809cf7d5fa5b521538d0d

SHA1
411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2

SHA256
55d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2

SHA512
b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5

Download Submit
\$Recycle.Bin\S-1-5-18\$bb8ab67ad8382496fd4eead6952e3208\n

Filesize
25KB

MD5
9e0cd37b6d0809cf7d5fa5b521538d0d

SHA1
411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2

SHA256
55d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2

SHA512
b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5

Download Submit
\$Recycle.Bin\S-1-5-21-3845472200-3839195424-595303356-1000\$bb8ab67ad8382496fd4eead6952e3208\n

Filesize
25KB

MD5
9e0cd37b6d0809cf7d5fa5b521538d0d

SHA1
411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2

SHA256
55d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2

SHA512
b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5

Download Submit
memory/1952-54-0x00000000753C1000-0x00000000753C3000-memory.dmp

Filesize
8KB

Download
memory/1952-57-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1952-58-0x000000000050E000-0x0000000000527000-memory.dmp

Filesize
100KB

Download
memory/1952-62-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1952-63-0x000000000050E000-0x0000000000527000-memory.dmp

Filesize
100KB

Download
memory/1952-65-0x000000000050E000-0x0000000000527000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing