db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193

Reason

Machine shutdown

General

Target

db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe
Size

43KB
MD5

6913fd0b7cf42c6bc466d52575d1d1f0
SHA1

637b805c072ba3a974e77fc8cf19ec1ad88298ca
SHA256

db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193
SHA512

d28c3ed694aaa5c07577fe78219a42cdfd4110591c7845c2aa003cecc2d556015a26f6e7052c30d99a125e4ade64437ab52783ff5eb8819a3111e700db2d8e5e
SSDEEP

768:u5DZ2Sai733ZL4OsPDsJOrvNQ3wzbYYiUCb6BJZObQC73m9BaNV9kAVy+6f/heT2:ji18OysUQpYiUCb9Z3dggy+9

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	WmInit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	WmInit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	WmInit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	WmInit.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\WmInit.exe = "C:\\Windows\\SysWOW64\\WmInit.exe:*:Enabled:Microsoft Windows Media"	WmInit.exe

Executes dropped EXE 1 IoCs

pid	Process
2068	WmInit.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	WmInit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Media = "C:\\Windows\\SysWOW64\\WmInit.exe"	WmInit.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tmp	WmInit.exe
File opened for modification	\??\c:\windows\SysWOW64\spoolsv.exe	WmInit.exe
File opened for modification	C:\Windows\SysWOW64\tmp	db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe
File created	C:\Windows\SysWOW64\tmp	db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe
File created	C:\Windows\SysWOW64\WmInit.dat	db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe
File opened for modification	C:\Windows\SysWOW64\WmInit.exe	db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe
File created	C:\Windows\SysWOW64\WmInit.exe	db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe
File opened for modification	C:\Windows\SysWOW64\tmp	WmInit.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	WmInit.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	WmInit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2068	WmInit.exe
2068	WmInit.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2068	WmInit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 2068	4300	db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe	83
PID 4300 wrote to memory of 2068	4300	db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe	83
PID 4300 wrote to memory of 2068	4300	db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe	83

C:\Users\Admin\AppData\Local\Temp\db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe
"C:\Users\Admin\AppData\Local\Temp\db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\SysWOW64\WmInit.exe
  "C:\Windows\system32\WmInit.exe" "C:\Users\Admin\AppData\Local\Temp\db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe"
  2⤵
  - Modifies firewall policy service
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WmInit.dat

Filesize
8B

MD5
f1047782af8e9a44a0016b1e74af52bf

SHA1
b16822553317851f9faa21232ab7fef77444826d

SHA256
b27c0860e731584cd7b8d273510580790573825d4b6ee170d4bc91bbc87df467

SHA512
74c63bcd97e0e63da5861c1b866ff6165056f018e726cc9b0bdda7c5be493edae5d33706c8ea3d9ab057e5b352b76cad8d825b64293ec4751b269d245a517140

Download Submit
C:\Windows\SysWOW64\WmInit.exe

Filesize
33.4MB

MD5
0d9a34a0689fe1cc7f4d4dd3493855ad

SHA1
2e227168f9682643dbc9ff0f0170d3ff165b901f

SHA256
72ffa0846c79bdc528fe070e0738ce5c42807696880aa0762775f9ed345a960a

SHA512
2a2acaf4fe867026a4e6bfc8476169331e33bb046857112b8f4bc65bfbbe4a88ec207205d49867d4d226c176548e38243a9ba504c4f142717b3c611e258f2e65

Download Submit
C:\Windows\SysWOW64\WmInit.exe

Filesize
33.4MB

MD5
0d9a34a0689fe1cc7f4d4dd3493855ad

SHA1
2e227168f9682643dbc9ff0f0170d3ff165b901f

SHA256
72ffa0846c79bdc528fe070e0738ce5c42807696880aa0762775f9ed345a960a

SHA512
2a2acaf4fe867026a4e6bfc8476169331e33bb046857112b8f4bc65bfbbe4a88ec207205d49867d4d226c176548e38243a9ba504c4f142717b3c611e258f2e65

Download Submit
memory/2068-139-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/2068-140-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4300-132-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4300-133-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/4300-138-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads