24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440

General

Target

24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Size

574KB
MD5

4e60dc6e67aa9ad641ace36dde34b3f6
SHA1

83d8e039cfc2b7ef857e230935f383e904246bba
SHA256

24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440
SHA512

70b2c6eec11908149e979542390db190ae78b4682c73351caf6e637a31a613eb4145140a360b73b4a26ce2529b1f962c5f1ee45a80e19adea903301295a77b6f
SSDEEP

12288:zh1iv0WABexeSy6nenyfEhf/hCXO84r0WrB77DfU9E75fgzzAyoO9o87:zuv/aezVenyfEhHhCXOvfUMgACy87

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\ACTIVE SETUP\INSTALLED COMPONENTS\öäÀy38@1 ¿4ƒ¼6wÌ@XS \\|Ò’¥%MØŒ¯ª0W¤¸‹5G}7tÃ €ß‹€Å¦ìO]n²¦àó9l?Ä< NG}B®¾‚¡Ÿ·%a1¢ÆY·8ÑÀzå?“ÓÁ·ÃZ\StubPath = "C:\\Windows\\\tN\x0e\x15G}B®¾‚¡Ÿ·%a1¢ÆY·8ÑÀzå?\x1d“ÓÁ·ÃZ 2"	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\ACTIVE SETUP\INSTALLED COMPONENTS\öäÀy38@1 ¿4ƒ¼6wÌ@XS \\|Ò’¥%MØŒ¯ª0W¤¸‹5G}7tÃ €ß‹€Å¦ìO]n²¦àó9l?Ä< NG}B®¾‚¡Ÿ·%a1¢ÆY·8ÑÀzå?“ÓÁ·ÃZ	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\ACTIVE SETUP\INSTALLED COMPONENTS\öäÀy38@1 ¿4ƒ¼6wÌ@XS	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\¢ÆY·8ÑÀzå?“ÓÁ·ÃZ = "C:\\Windows\\\tN\x0e\x15G}B®¾‚¡Ÿ·%a1¢ÆY·8ÑÀzå?\x1d“ÓÁ·ÃZ"	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUNONCE\*¢ÆY·8ÑÀzå?“ÓÁ·ÃZ = "C:\\Windows\\\tN\x0e\x15G}B®¾‚¡Ÿ·%a1¢ÆY·8ÑÀzå?\x1d“ÓÁ·ÃZ"	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RUNONCE\*¢ÆY·8ÑÀzå?“ÓÁ·ÃZ = "C:\\Windows\\\tN\x0e\x15G}B®¾‚¡Ÿ·%a1¢ÆY·8ÑÀzå?\x1d“ÓÁ·ÃZ"	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\MICROSOFT\WINDOWS\CURRENTVERSION\RUN	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\¢ÆY·8ÑÀzå?“ÓÁ·ÃZ = "C:\\Windows\\\tN\x0e\x15G}B®¾‚¡Ÿ·%a1¢ÆY·8ÑÀzå?\x1d“ÓÁ·ÃZ"	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ NG}B®¾‚¡Ÿ·%a1¢ÆY·8ÑÀzå?“ÓÁ·ÃZ	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1944	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 1288	1944	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe	14
PID 1944 wrote to memory of 1288	1944	24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1288
- C:\Users\Admin\AppData\Local\Temp\24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe
  "C:\Users\Admin\AppData\Local\Temp\24d3359e3211d73f1f777d53840d34c1d785a2a0cbed89060e1f94946b78e440.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1944

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1944-54-0x0000000000400000-0x0000000000494000-memory.dmp

Filesize
592KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads