b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e

General

Target

b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
Size

591KB
MD5

91331c14e26e9e41e588f9b55da3b230
SHA1

b4fbe572015f105731e78460ae2fcc2789658d3b
SHA256

b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e
SHA512

b52802cddad9b390c37f6dab2af8a28bcc3746df08d9b5ced18b996344e78ebfb4fe6a929016bf1f5618f601ee41def399992eec5b1a017a443702621e4bd7af
SSDEEP

12288:UsAqMGHGSX1388BxGVI43GVpinJMcODu5bsIJojfwzBWZkrpxEvA+H1hR:UsBbW1SaRhaLAUkIv3hR

Score

10^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	spoolsv.exe

Executes dropped EXE 1 IoCs

pid	Process
988	spoolsv.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}\StubPath = "msoeq32.exe"	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}\StubPath = "msoeq32.exe"	spoolsv.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\VCL = "vcl32.exe"	spoolsv.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\msoeq32.exe	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
File created	C:\Windows\SysWOW64\concp32.exe	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
File opened for modification	C:\Windows\SysWOW64\concp32.exe	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
File created	C:\Windows\SysWOW64\vcl32.exe	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
File opened for modification	C:\Windows\SysWOW64\vcl32.exe	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
File created	C:\Windows\SysWOW64\msoeq32.exe	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\spoolsv.exe	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
File opened for modification	C:\Windows\spoolsv.exe	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}\ax = 252605f680ef31ae63946866668aa8d6	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}\u0 = 658663d26f8bad325217a06063847056939f558d910ed252e05dd0113550f7fc0f4da82ff73a0681ba604c2d4f23269f	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}\v = "165"	spoolsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}\InprocServer32	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}\sm = 01b8ec350471bd332433eee476ebe1f3	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}	spoolsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}\InprocServer32	spoolsv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}\u1 = 551d2e0658054ba756fd3798fea5ffca42865cb762a31639dabd7f2cca44e226	spoolsv.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}\u2 = a54a6b702f92fdf2acd57599e2ae1608015dff41aa020117fc9bd8e2dcf4340f3fa61eb55d6f28597df90602703809d4	spoolsv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\SysWow64\\concp32.exe \"%1\" %*"	spoolsv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F1728D27-8B9A-11D5-EBA1-F78EEEEEE983}	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1696	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 988	1696	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe	27
PID 1696 wrote to memory of 988	1696	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe	27
PID 1696 wrote to memory of 988	1696	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe	27
PID 1696 wrote to memory of 988	1696	b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe	27

C:\Users\Admin\AppData\Local\Temp\b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe
"C:\Users\Admin\AppData\Local\Temp\b10ff1fa8eb9d1ffdc99d5c87a4ebce6992318a5ea52829a6010078d66736e4e.exe"
1⤵
- Modifies system executable filetype association
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\spoolsv.exe
  C:\Windows\spoolsv.exe
  2⤵
  - Modifies system executable filetype association
  - Executes dropped EXE
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Modifies registry class
  PID:988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\spoolsv.exe

Filesize
594KB

MD5
626b76f919f8a67fe170036aa1e4d35d

SHA1
64e9e9b71a77210061f8e07108c144caa7832d8a

SHA256
01932254225f8700d0eeda85528282ce3549c294623d782300365cc9c08f3d80

SHA512
fad375128ec4c4c33f338b44a983ce264c23e62f8b98761d88b22b42b25b2a22c8dfbeecb65c572cc9d2ee5c3485c9cd01e485f61e18d61b272da71a2c3f0841

Download Submit
memory/988-58-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/988-59-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1696-54-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1696-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads