c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0

General

Target

c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe
Size

29KB
MD5

5c5e9e6599de61021dfbcdf0f13001b0
SHA1

5674f03e062de5648991a75ef0bd4cf887714d6c
SHA256

c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0
SHA512

6d8bd133208b031fd8973849ab3b78096b3fda4a2338b20d195e034cd58ee5c2d0aa59c9862e904509ee723536e5670852329ba050a5eae8089fc0f6a4dffb78
SSDEEP

384:XlTlqdHX6yjJsugzW7gocBwWnHhejcjUdJIrg+LPgHanBYA7+fLITB:XlJG36mJY0gocXnBpjUZsYVTf0T

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0"	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0"	svchost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Avt-Net\Parameters\ServiceDll = "%SystemRoot%\\system32\\svcnet32.dll"	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Avt-Net\ImagePath = "%SystemRoot%\\system32\\svchost -k Avt-Net"	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe

Loads dropped DLL 1 IoCs

pid	Process
3360	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svcnet32.dll	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe
File opened for modification	C:\Windows\SysWOW64\svcnet32.dll	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchost.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\syslass.cpl	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe
File created	C:\Program Files (x86)\syslass.cpl\Ylack.exe	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe
File opened for modification	C:\Program Files (x86)\syslass.cpl	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0"	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\NeverShowExt = "0"	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4952	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3360	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 1032	4952	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe	83
PID 4952 wrote to memory of 1032	4952	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe	83
PID 4952 wrote to memory of 1032	4952	c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe	83

C:\Users\Admin\AppData\Local\Temp\c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe
"C:\Users\Admin\AppData\Local\Temp\c7739b8c31104d2c1ee1a600e797d5a21de0951b6a5e53a9724d91c68b40a5f0.exe"
1⤵
- Modifies system executable filetype association
- Modifies visiblity of hidden/system files in Explorer
- Sets DLL path for service in the registry
- Sets service image path in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\C7739B~1.EXE > nul
  2⤵
  PID:1032

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost -k Avt-Net -s Avt-Net
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\svcnet32.dll

Filesize
12KB

MD5
3199bcf2556420e775f5fde0e05f15ea

SHA1
fc68354e1a3dea610d1736929bbc805f4e648658

SHA256
b05e51db13ff045333333f0b5b366a51817c9e99697481c82cd71778c9784054

SHA512
2eeb85a4cfd2b4214078fd30b3aab0c83326c04f25450e6db672a482df87987f0baf635b1bf53f77b0c324507f8817d0d5ed1c096c6641a76b717ab26a833ca6

Download Submit
\??\c:\windows\SysWOW64\svcnet32.dll

Filesize
12KB

MD5
3199bcf2556420e775f5fde0e05f15ea

SHA1
fc68354e1a3dea610d1736929bbc805f4e648658

SHA256
b05e51db13ff045333333f0b5b366a51817c9e99697481c82cd71778c9784054

SHA512
2eeb85a4cfd2b4214078fd30b3aab0c83326c04f25450e6db672a482df87987f0baf635b1bf53f77b0c324507f8817d0d5ed1c096c6641a76b717ab26a833ca6

Download Submit
memory/4952-132-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4952-136-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads