b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1

General

Target

b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
Size

196KB
MD5

832bfccc53c058b5f6ad06c8aa09cd10
SHA1

1015252c988fca543e287c2ad52cd99c973e4e4b
SHA256

b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1
SHA512

5d17cf48166bcfef18b93f1c20c453d0a4bba68c59a228f3ac8d96190e1d1774f691e19fafbf6713b119678ab00a0f21124be38c83e93cea7a082d3b53e5f112
SSDEEP

3072:5ARLouoHOwtTe2MjKGwTUu7ZpThEiX0+b+lfd1xft5uYAkSwJPlI57VN6z6kl:SsjOKSu7ZpdEngUZFqp5RPk

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe"	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\runouce.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File created	C:\Windows\SysWOW64\runouce.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1056	112	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe	28
PID 112 wrote to memory of 1056	112	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe	28
PID 112 wrote to memory of 1056	112	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe	28
PID 112 wrote to memory of 1056	112	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe	28
PID 112 wrote to memory of 1056	112	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe	28
PID 112 wrote to memory of 1056	112	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe	28
PID 112 wrote to memory of 1056	112	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe	28
PID 112 wrote to memory of 1212	112	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe	15
PID 112 wrote to memory of 1212	112	b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe	15

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212
- C:\Users\Admin\AppData\Local\Temp\b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
  "C:\Users\Admin\AppData\Local\Temp\b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Users\Admin\AppData\Local\Temp\b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe
    "C:\Users\Admin\AppData\Local\Temp\b5de1571f9ca30cff82a763e5b812eeab0bd07418b9695baa682890fe1cf27d1.exe"
    3⤵
    PID:1056

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/112-60-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/112-61-0x0000000000230000-0x0000000000265000-memory.dmp

Filesize
212KB

Download
memory/112-62-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1056-57-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1212-58-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing