ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c

General

Target

ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Size

124KB
MD5

6607ec099b7945aedf71527c242b0bf8
SHA1

023d20cd841fc7faf7ce22e4509b6471c54cb042
SHA256

ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c
SHA512

3300875773d6282bfda41f429f2aa1030b9879bf0e30303d215a862623692494b2b0531d2a9d9aa7ffb77277c59834e8f13eaf5910f761edcf3b626aeffff238
SSDEEP

3072:azDJgFDoO+DtN0MQxPXQXYakWozv1z2M3g3uBkjvy1:aZgloPDtN0M2XwqJN2qg3umjvy1

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2592	Explorer.EXE

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2295526160-1155304984-640977766-1000\\$e0613d909b67ae6058f9584af5f18b89\\n."	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2295526160-1155304984-640977766-1000\\$e0613d909b67ae6058f9584af5f18b89\\n."	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\clsid	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
2592	Explorer.EXE
2592	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Token: SeDebugPrivilege	4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Token: SeDebugPrivilege	4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
Token: SeDebugPrivilege	2592	Explorer.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2592	4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe	45
PID 4372 wrote to memory of 2592	4372	ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe	45

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2592
- C:\Users\Admin\AppData\Local\Temp\ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe
  "C:\Users\Admin\AppData\Local\Temp\ff77ccb3c250c34adfb02959c8051c8895c3909899a3002532b53f3c74ac5d4c.exe"
  2⤵
  - Registers COM server for autorun
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4372

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\$e0613d909b67ae6058f9584af5f18b89\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\$e0613d909b67ae6058f9584af5f18b89\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit

Analysis

Sharing