72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced

General

Target
72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe
Size 565KB
Sample221020-clsl4saahk
SHA256 72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced
MD5 736f0e571659ee8e27ef7787dac0bf60
SHA1 03154f19d8b147edffc7d8f8840bc81342b4a11e
SHA512 76d4d6e76d87f5faaec5bc1c286040b4164cba82d2c4077695569ffa7c66cf9f4cdef648e0c8815884ba84c2f872c95267d4b8a63f60ea61fd8fbe7366ebeb3e
SSDEEP 12288:MZ4TDDmNOzKnDAWo1s5MV6VIzqmG+05CXZC2kTuhRUWLFZuJGNO:v/qsKUJ1saga23C5krYFZuiO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe

Executes dropped EXE 1 IoCs

pid	Process
1372	B49ACAC9DC9F5FB6.TMP

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FrameWork = "C:\\Windows\\system32\\WinMain.exe 6666"	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WinMain.exe	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe
File created	C:\Windows\SysWOW64\WinMain.exe	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4532	1372	WerFault.exe	82

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4344	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 1372	1300	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe	82
PID 1300 wrote to memory of 1372	1300	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe	82
PID 1300 wrote to memory of 1372	1300	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe	82
PID 1300 wrote to memory of 556	1300	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe	83
PID 1300 wrote to memory of 556	1300	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe	83
PID 1300 wrote to memory of 556	1300	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe	83
PID 1300 wrote to memory of 4344	1300	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe	84
PID 1300 wrote to memory of 4344	1300	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe	84
PID 1300 wrote to memory of 4344	1300	72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe	84

C:\Users\Admin\AppData\Local\Temp\72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe
"C:\Users\Admin\AppData\Local\Temp\72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Users\Admin\AppData\Local\Temp\B49ACAC9DC9F5FB6.TMP
  "C:\Users\Admin\AppData\Local\Temp\B49ACAC9DC9F5FB6.TMP"
  2⤵
  - Executes dropped EXE
  PID:1372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 224
    3⤵
    - Program crash
    PID:4532
- C:\Users\Admin\AppData\Local\Temp\72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe
  7777
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Adds Run key to start application
  - Drops file in System32 directory
  PID:556
- C:\Users\Admin\AppData\Local\Temp\72824fcc1f45013233b4f4e6ebf06b34b54352d742ce9dd2b3286518e1068ced.exe
  9999
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1372 -ip 1372
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B49ACAC9DC9F5FB6.TMP

Path C:\Users\Admin\AppData\Local\Temp\B49ACAC9DC9F5FB6.TMP
Size 277KB
SHA256 5f3f2e008a44ff63ae713186690b6398bf243e742caf87d1813ea3f8c8bea685
MD5 ed379641c504b3dafae5edffeddb9bb6
SHA1 71e89491e27c80eb000ca507fdea3dfe59e7f531
SHA512 a00e4d6558e15e2f733dfbe9518aad1e37a603010ff35fa708bf15a529dfffab4a8c9bcb2133b9d0e1e07a289e31db00aad6328abfd05932115d2a5815dd156e
SSDEEP 6144:X4cSG+055YFxdfzX3C2kmgu3LI4FgOXnVbx0T6UrMhLg1iOcwOrcXqOGmh+O8tI:2G+05CXZC2kTuhRUWLFZuJGNO
MD5 SHA1 SHA512 SSDEEP

Submit Download

B49ACAC9DC9F5FB6.TMP

Path C:\Users\Admin\AppData\Local\Temp\B49ACAC9DC9F5FB6.TMP
Size 277KB
SHA256 5f3f2e008a44ff63ae713186690b6398bf243e742caf87d1813ea3f8c8bea685
MD5 ed379641c504b3dafae5edffeddb9bb6
SHA1 71e89491e27c80eb000ca507fdea3dfe59e7f531
SHA512 a00e4d6558e15e2f733dfbe9518aad1e37a603010ff35fa708bf15a529dfffab4a8c9bcb2133b9d0e1e07a289e31db00aad6328abfd05932115d2a5815dd156e
SSDEEP 6144:X4cSG+055YFxdfzX3C2kmgu3LI4FgOXnVbx0T6UrMhLg1iOcwOrcXqOGmh+O8tI:2G+05CXZC2kTuhRUWLFZuJGNO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/556-139-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/1300-132-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/1300-141-0x0000000000400000-0x0000000000490000-memory.dmp

Download

memory/1372-140-0x0000000000400000-0x0000000000529000-memory.dmp

Download

memory/4344-138-0x0000000000400000-0x0000000000490000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads