11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8

General

Target

11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Size

60KB
MD5

921532d96f4b89101035374a84f9ffe0
SHA1

dd72f16d97f810da90af0c12fc26999a7a2e455f
SHA256

11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8
SHA512

23ed51f061d5b15110324fa948a97670a0e42bb7494146da4dae03d1e11f2d6cbb85035b54bace396e7f15b70f135bd34d490baf8634ff76daf1086b58369a78
SSDEEP

1536:8KqxQGmzLOJXEm5pnnvKfM0cu5tz9r4KbBi6GePt:Ej4kEm76cOzJbi6Ge

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe:*:Enabled:svchost"	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe:*:Enabled:svchost"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe:*:Enabled:svchost"	svchost.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe:*:Enabled:svchost"	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe

Executes dropped EXE 1 IoCs

pid	Process
1556	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1652	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
1652	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe"	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateSvchost = "C:\\Users\\Admin\\AppData\\Roaming\\nightupdate\\svchost.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1556	1652	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe	27
PID 1652 wrote to memory of 1556	1652	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe	27
PID 1652 wrote to memory of 1556	1652	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe	27
PID 1652 wrote to memory of 1556	1652	11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe	27

C:\Users\Admin\AppData\Local\Temp\11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe
"C:\Users\Admin\AppData\Local\Temp\11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8.exe"
1⤵
- Modifies firewall policy service
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Roaming\nightupdate\svchost.exe
  "C:\Users\Admin\AppData\Roaming\nightupdate\svchost.exe"
  2⤵
  - Modifies firewall policy service
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\nightupdate\svchost.exe

Filesize
60KB

MD5
921532d96f4b89101035374a84f9ffe0

SHA1
dd72f16d97f810da90af0c12fc26999a7a2e455f

SHA256
11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8

SHA512
23ed51f061d5b15110324fa948a97670a0e42bb7494146da4dae03d1e11f2d6cbb85035b54bace396e7f15b70f135bd34d490baf8634ff76daf1086b58369a78

Download Submit
\Users\Admin\AppData\Roaming\nightupdate\svchost.exe

Filesize
60KB

MD5
921532d96f4b89101035374a84f9ffe0

SHA1
dd72f16d97f810da90af0c12fc26999a7a2e455f

SHA256
11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8

SHA512
23ed51f061d5b15110324fa948a97670a0e42bb7494146da4dae03d1e11f2d6cbb85035b54bace396e7f15b70f135bd34d490baf8634ff76daf1086b58369a78

Download Submit
\Users\Admin\AppData\Roaming\nightupdate\svchost.exe

Filesize
60KB

MD5
921532d96f4b89101035374a84f9ffe0

SHA1
dd72f16d97f810da90af0c12fc26999a7a2e455f

SHA256
11ba7786f3413f27d78ee7a61e765e17a74c1255a426ffe4d05fd66d4a4ed4c8

SHA512
23ed51f061d5b15110324fa948a97670a0e42bb7494146da4dae03d1e11f2d6cbb85035b54bace396e7f15b70f135bd34d490baf8634ff76daf1086b58369a78

Download Submit
memory/1652-54-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads