ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c

General

Target

ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Size

124KB
MD5

6607ec099b7945aedf71527c242b0bf8
SHA1

023d20cd841fc7faf7ce22e4509b6471c54cb042
SHA256

ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c
SHA512

3300875773d6282bfda41f429f2aa1030b9879bf0e30303d215a862623692494b2b0531d2a9d9aa7ffb77277c59834e8f13eaf5910f761edcf3b626aeffff238
SSDEEP

3072:azDJgFDoO+DtN0MQxPXQXYakWozv1z2M3g3uBkjvy1:aZgloPDtN0M2XwqJN2qg3umjvy1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1368	Explorer.EXE
464	services.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-999675638-2867687379-27515722-1000\\$f545a6cb63874d75375b4ac5befd06b3\\n."	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$f545a6cb63874d75375b4ac5befd06b3\\n."	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-999675638-2867687379-27515722-1000\\$f545a6cb63874d75375b4ac5befd06b3\\n."	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$f545a6cb63874d75375b4ac5befd06b3\\n."	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\clsid	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
464	services.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Token: SeDebugPrivilege	748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Token: SeDebugPrivilege	748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Token: SeDebugPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1368	Explorer.EXE
1368	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1368	Explorer.EXE
1368	Explorer.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1368	748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe	17
PID 748 wrote to memory of 1368	748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe	17
PID 748 wrote to memory of 464	748	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe	2

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1368
- C:\Users\Admin\AppData\Local\Temp\ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
  "C:\Users\Admin\AppData\Local\Temp\ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe"
  2⤵
  - Registers COM server for autorun
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-18\$f545a6cb63874d75375b4ac5befd06b3\@

Filesize
2KB

MD5
497ad85af4e8104630a238b4a208c3cd

SHA1
037c6b04eac29281aa20fa4938ca3e4099a8c7c6

SHA256
0ce64b5d9614480a89e8bcdad2f370a7ed9defae5195e24ce90494dae08b18d1

SHA512
6c16e22744495efd55ca69cfb04c4e660852e55843222fae8c9bf3e6ba47de981bb0e5c67edd7c3f346d12727575c74b0a5b56c7bc008491c5da8f5acc989d57

Download Submit
C:\$Recycle.Bin\S-1-5-18\$f545a6cb63874d75375b4ac5befd06b3\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
C:\$Recycle.Bin\S-1-5-21-999675638-2867687379-27515722-1000\$f545a6cb63874d75375b4ac5befd06b3\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
\$Recycle.Bin\S-1-5-18\$f545a6cb63874d75375b4ac5befd06b3\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
\$Recycle.Bin\S-1-5-21-999675638-2867687379-27515722-1000\$f545a6cb63874d75375b4ac5befd06b3\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit

Analysis

Sharing