d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a

General

Target

d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
Size

70KB
MD5

00a24b7f6d79d070c6aa154e02d3a6e6
SHA1

e3847d99b1d2d1e3817c2b05ea91027e7a7b77f8
SHA256

d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a
SHA512

bcf2f865b409eadb754e48ed8f4b59f1209109d23fe7edb32f17c024a5f7ae9f890c9912ea883f31a1019372ff796dc39c9a2f0bb395d2a831693acbb1e39c40
SSDEEP

1536:9rUFD/C0WWum6e6mmfASwwb5RUUgojiiAT16dg5Pxx74jv:BcDaNWuhe69fXwwb5RUUgoG/T1Ag534b

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ctfmon = "C:\\Windows\\TEMP\\services.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msmmsgr = "C:\\Windows\\TEMP\\x\\services.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4464 set thread context of 2872	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	82

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2592	reg.exe
628	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2872	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
2872	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
2872	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
2872	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 3504	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	80
PID 4464 wrote to memory of 3504	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	80
PID 4464 wrote to memory of 3504	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	80
PID 4464 wrote to memory of 3960	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	81
PID 4464 wrote to memory of 3960	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	81
PID 4464 wrote to memory of 3960	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	81
PID 4464 wrote to memory of 2872	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	82
PID 4464 wrote to memory of 2872	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	82
PID 4464 wrote to memory of 2872	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	82
PID 4464 wrote to memory of 2872	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	82
PID 4464 wrote to memory of 2872	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	82
PID 4464 wrote to memory of 2872	4464	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	82
PID 3960 wrote to memory of 2592	3960	cmd.exe	85
PID 3960 wrote to memory of 2592	3960	cmd.exe	85
PID 3960 wrote to memory of 2592	3960	cmd.exe	85
PID 3504 wrote to memory of 628	3504	cmd.exe	86
PID 3504 wrote to memory of 628	3504	cmd.exe	86
PID 3504 wrote to memory of 628	3504	cmd.exe	86
PID 2872 wrote to memory of 1272	2872	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	35
PID 2872 wrote to memory of 1272	2872	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	35
PID 2872 wrote to memory of 1272	2872	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	35
PID 2872 wrote to memory of 1272	2872	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	35
PID 2872 wrote to memory of 1272	2872	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	35
PID 2872 wrote to memory of 1272	2872	d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe	35

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1272
- C:\Users\Admin\AppData\Local\Temp\d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
  "C:\Users\Admin\AppData\Local\Temp\d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v msmmsgr /t REG_SZ /d "C:\Windows\TEMP\x\services.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v msmmsgr /t REG_SZ /d "C:\Windows\TEMP\x\services.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ctfmon /t REG_SZ /d "C:\Windows\TEMP\services.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v ctfmon /t REG_SZ /d "C:\Windows\TEMP\services.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:2592
- - C:\Users\Admin\AppData\Local\Temp\d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
    C:\Users\Admin\AppData\Local\Temp\d4656eb7b9a56a75d9489113d2c1f8ba15b3ea17d1640427bfdc0ebbef57580a.exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-140-0x000000007FFC0000-0x000000007FFC6000-memory.dmp

Filesize
24KB

Download
memory/2872-135-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2872-139-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2872-141-0x0000000010000000-0x0000000010011000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads