abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af

General

Target

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe
Size

145KB
MD5

d9e0b4fc74b9b247145c425d37376cdc
SHA1

95c1049fe15fa8550d7a4cee28e0121c516a7dce
SHA256

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af
SHA512

c8314e989a532cd979d0f1994d274f5420dc69a1370282f07668d21be0c3745c877b45254be83ca4b4983a26f76d72da5228353c2f11ccfb1de9af6ede22b715
SSDEEP

1536:p9SS9CRjbBeA5U668zy9DQRg8fssPh2b/UVJMcv287gv3maoYtH96qD4gu:PoZ8A5U668G9+DPYuvhVYlD4B

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

svcnost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	svcnost.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\xaigfrffj3guknbkaxyokwduxw1vldla2\svcnost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\xaigfrffj3guknbkaxyokwduxw1vldla2\\svcnost.exe:*:Enabled:ldrsoft"	svcnost.exe

Drops file in Drivers directory 1 IoCs

Processes:

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

description ioc process

File created C:\Windows\system32\drivers\etc\hosts abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

description	ioc	process
File created	C:\Windows\system32\drivers\etc\hosts	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/964-55-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/964-58-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/1072-64-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/964-66-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/964-67-0x0000000000400000-0x0000000000462000-memory.dmp	upx
behavioral1/memory/1072-68-0x0000000000400000-0x0000000000462000-memory.dmp	upx

Loads dropped DLL 2 IoCs

Processes:

svcnost.exe

pid process

1072 svcnost.exe
1072 svcnost.exe

pid	process
1072	svcnost.exe
1072	svcnost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Init = "\"C:\\Users\\Admin\\AppData\\Roaming\\xaigfrffj3guknbkaxyokwduxw1vldla2\\svcnost.exe\""	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

svcnost.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\desktop.ini	svcnost.exe
File created	C:\Users\Admin\AppData\Roaming\desktop.ini	svcnost.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

svcnost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry	svcnost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\SavedLegacySettingsML = 363231333137363138	svcnost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

pid process

964 abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

pid process

964 abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe
Suspicious use of UnmapMainImage 2 IoCs

Processes:

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exesvcnost.exe

pid process

964 abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe
1072 svcnost.exe

pid	process
964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

pid	process
964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

pid	process
964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe
1072	svcnost.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe

description	pid	process	target process
PID 964 wrote to memory of 1072	964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe	svcnost.exe
PID 964 wrote to memory of 1072	964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe	svcnost.exe
PID 964 wrote to memory of 1072	964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe	svcnost.exe
PID 964 wrote to memory of 1072	964	abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe	svcnost.exe

C:\Users\Admin\AppData\Local\Temp\abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe
"C:\Users\Admin\AppData\Local\Temp\abf76f018477df502d20c18b01a42f7780f32a3bb12bb6820d90bef78558c1af.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:964

C:\Users\Admin\AppData\Roaming\xaigfrffj3guknbkaxyokwduxw1vldla2\svcnost.exe
"C:\Users\Admin\AppData\Roaming\xaigfrffj3guknbkaxyokwduxw1vldla2\svcnost.exe"
2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Suspicious use of UnmapMainImage
PID:1072

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\desktop.ini
Filesize
9KB

MD5
4a27242b307c6a836993353035fafc16

SHA1
5fea7a41b8f9071848108015d8a952e6f944eea0

SHA256
02fd93f64bda51e1e2991184cac13f077d509712e462c9e44be9cf8e22c06de1

SHA512
35e9c87642b82df2bf0a9312bb0e9abfb98282db1e34032a4d0150d82c5e2f2e13150ddc896f1e954f02288a1e696a4306ee595b94b1e404c6ec17bac64c44be

Download Submit
\Users\Admin\AppData\Roaming\ntuser.dat
Filesize
54KB

MD5
7e8e966927e04a35aec644602b8a9e05

SHA1
d201b0b41e8701818d60ddbf9f334332a512c4da

SHA256
46f18d9fbf63f378d86962cbf24f5ce57ce257555acd4effdcc41c1e2f1adf5c

SHA512
246777c79129a5076b71ca5d3f7e59b06d344f6b5e771892ae8ee68c0b5af9207cd1868b1336b49e6a84665309ad379a33ec6c8e72d7ce41de72153637921a51

Download Submit
memory/964-58-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/964-56-0x0000000000320000-0x0000000000382000-memory.dmp

Filesize
392KB

Download
memory/964-54-0x0000000074D71000-0x0000000074D73000-memory.dmp

Filesize
8KB

Download
memory/964-55-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/964-57-0x0000000000390000-0x00000000003F2000-memory.dmp

Filesize
392KB

Download
memory/964-67-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/964-66-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1072-64-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1072-63-0x0000000000380000-0x00000000003E2000-memory.dmp

Filesize
392KB

Download
memory/1072-68-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/1072-62-0x0000000000310000-0x0000000000372000-memory.dmp

Filesize
392KB

Download
memory/1072-70-0x0000000000260000-0x000000000027D000-memory.dmp

Filesize
116KB

Download
memory/1072-59-0x0000000000000000-mapping.dmp

Download
memory/1072-72-0x0000000000260000-0x000000000027D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads