6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0

General

Target

6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
Size

197KB
MD5

00f7b34dc1811aca1399d0c0036b434a
SHA1

f30db8ee9d261066eecee7669e0e2b9cfaaee840
SHA256

6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0
SHA512

b04b884dff3a752d5c7840d289dfd00ff2e53fcc04ed872dea9009a4f8dc1f0c8bd811ae3263c6ec6f604851b10bc1d7f99088891ee18acfd4b022f01498b47d
SSDEEP

3072:1rOXOttN91koHGraJh1mnS1Gz2xMLGDLTM4lx3OPHfEjBXJBv+Kj2veZy+7c++go:4XM3orab1mSO2fBx3OP/s5V7k+Y9

Score

8^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2629973501-4017243118-3254762364-1000\\$8dceb85e8508ee5bcccc98a6b145e6ef\\n."	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe

Loads dropped DLL 1 IoCs

pid	Process
376	Explorer.EXE

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2629973501-4017243118-3254762364-1000\\$8dceb85e8508ee5bcccc98a6b145e6ef\\n."	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\clsid	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
Token: SeDebugPrivilege	1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
Token: SeDebugPrivilege	1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 376	1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe	37
PID 1608 wrote to memory of 376	1608	6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe	37

C:\Users\Admin\AppData\Local\Temp\6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe
"C:\Users\Admin\AppData\Local\Temp\6fb753dd794c7475397642d179c1ed32b7d9fbc015dd3b4d454920e43fe422f0.exe"
1⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Loads dropped DLL
PID:376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\$8dceb85e8508ee5bcccc98a6b145e6ef\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\$8dceb85e8508ee5bcccc98a6b145e6ef\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
memory/1608-133-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1608-132-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1608-135-0x0000000002050000-0x0000000002085000-memory.dmp

Filesize
212KB

Download
memory/1608-134-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1608-136-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1608-140-0x0000000002050000-0x0000000002085000-memory.dmp

Filesize
212KB

Download
memory/1608-139-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing