94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c

General

Target

94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Size

448KB
MD5

5860f46389a0742c5462ea140bccee71
SHA1

46fbe50d7b31bc66029bb43130161038b5a2b602
SHA256

94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c
SHA512

5a45af944943394224818c40433b4dbf3c294fefbb4485fccf8f256a470077d0fd80287c53bd8235a238b11a80ef9ade8d5474cdb351d1a24e8b6d24bb4ecbd2
SSDEEP

6144:8h5IVKmFs4Hb4I2HIEi+nPHawdn0/JRSerTWIdeFjkZM6jI7F1eZ9A3R:45IVKCsC4IsKRFqIQFjkZM6jI7TeZ2

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 8 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

1752 reg.exe
1972 reg.exe
1104 reg.exe
548 reg.exe

pid	process
1752	reg.exe
1972	reg.exe
1104	reg.exe
548	reg.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe

description	pid	process
Token: 1	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeCreateTokenPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeAssignPrimaryTokenPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeLockMemoryPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeIncreaseQuotaPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeMachineAccountPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeTcbPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeSecurityPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeTakeOwnershipPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeLoadDriverPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeSystemProfilePrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeSystemtimePrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeProfSingleProcessPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeIncBasePriorityPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeCreatePagefilePrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeCreatePermanentPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeBackupPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeRestorePrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeShutdownPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeDebugPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeAuditPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeSystemEnvironmentPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeChangeNotifyPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeRemoteShutdownPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeUndockPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeSyncAgentPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeEnableDelegationPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeManageVolumePrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeImpersonatePrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: SeCreateGlobalPrivilege	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: 31	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: 32	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: 33	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: 34	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
Token: 35	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe

pid	process
1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1988 wrote to memory of 1336	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1336	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1336	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1336	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1152	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1152	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1152	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1152	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1912	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1912	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1912	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1912	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1496	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1496	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1496	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1988 wrote to memory of 1496	1988	94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe	cmd.exe
PID 1336 wrote to memory of 1104	1336	cmd.exe	reg.exe
PID 1336 wrote to memory of 1104	1336	cmd.exe	reg.exe
PID 1336 wrote to memory of 1104	1336	cmd.exe	reg.exe
PID 1336 wrote to memory of 1104	1336	cmd.exe	reg.exe
PID 1152 wrote to memory of 1972	1152	cmd.exe	reg.exe
PID 1152 wrote to memory of 1972	1152	cmd.exe	reg.exe
PID 1152 wrote to memory of 1972	1152	cmd.exe	reg.exe
PID 1152 wrote to memory of 1972	1152	cmd.exe	reg.exe
PID 1912 wrote to memory of 1752	1912	cmd.exe	reg.exe
PID 1912 wrote to memory of 1752	1912	cmd.exe	reg.exe
PID 1912 wrote to memory of 1752	1912	cmd.exe	reg.exe
PID 1912 wrote to memory of 1752	1912	cmd.exe	reg.exe
PID 1496 wrote to memory of 548	1496	cmd.exe	reg.exe
PID 1496 wrote to memory of 548	1496	cmd.exe	reg.exe
PID 1496 wrote to memory of 548	1496	cmd.exe	reg.exe
PID 1496 wrote to memory of 548	1496	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe
"C:\Users\Admin\AppData\Local\Temp\94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1104

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1752

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe:*:Enabled:Windows Messanger" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\94254494e073d33c2ea7b455feb814a162ee2803ebf74fbd152d1aa46616246c.exe:*:Enabled:Windows Messanger" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1972

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f
3⤵
- Modifies firewall policy service
- Modifies registry key
PID:548

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/548-65-0x0000000000000000-mapping.dmp

Download
memory/1104-62-0x0000000000000000-mapping.dmp

Download
memory/1152-59-0x0000000000000000-mapping.dmp

Download
memory/1336-58-0x0000000000000000-mapping.dmp

Download
memory/1496-61-0x0000000000000000-mapping.dmp

Download
memory/1752-64-0x0000000000000000-mapping.dmp

Download
memory/1912-60-0x0000000000000000-mapping.dmp

Download
memory/1972-63-0x0000000000000000-mapping.dmp

Download
memory/1988-57-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads