cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3

General

Target

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
Size

382KB
MD5

661c5b91f9c04b8b7786ba8879f5f022
SHA1

79d9cc8247d68b169a78fe4d1a18c790619f4e46
SHA256

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3
SHA512

ac9d1eb65377d6fd9da780ec6190ae64538bffabeebd72fd620c216b9b39c32222c64505e72ab52ea15e8e9439a5f0bd23c5d6dafece8d0b0fda03bcfd6070bc
SSDEEP

6144:6byYQvVfG6dg882DVaYq4sMPPEUygjzn8eIzgjIE3k57A4FP:6FeNBgpgVaYlsTy8nEkGss4FP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

alter.exe

pid process

1792 alter.exe
Deletes itself 1 IoCs

Processes:

alter.exe

pid process

1792 alter.exe
Loads dropped DLL 1 IoCs

Processes:

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe

pid process

1888 cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

alter.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	alter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\alter.exe"	alter.exe

Drops file in System32 directory 3 IoCs

Processes:

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\whr458da.db
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\whr458da.db
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat

Drops file in Windows directory 2 IoCs

Processes:

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exealter.exe

description	ioc	process
File opened for modification	C:\Windows\cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.INI	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
File opened for modification	C:\Windows\alter.INI	alter.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECEB6828-BFAD-4A2A-9F45-AC16405E2937}\WpadNetworkName = "Network 2"
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-b2-73-37-be-2f\WpadDecisionTime = 304bae783dffd801
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECEB6828-BFAD-4A2A-9F45-AC16405E2937}
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECEB6828-BFAD-4A2A-9F45-AC16405E2937}\WpadDecision = "0"
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECEB6828-BFAD-4A2A-9F45-AC16405E2937}\ee-b2-73-37-be-2f
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-b2-73-37-be-2f\WpadDecisionReason = "1"
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-b2-73-37-be-2f\WpadDecision = "0"
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f004f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECEB6828-BFAD-4A2A-9F45-AC16405E2937}\WpadDecisionTime = 304bae783dffd801
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{ECEB6828-BFAD-4A2A-9F45-AC16405E2937}\WpadDecisionReason = "1"
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ee-b2-73-37-be-2f
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

alter.exe

pid	process
1792	alter.exe
1792	alter.exe
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588
588

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

alter.exe

pid process

1792 alter.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

alter.exe

description pid process

Token: SeDebugPrivilege 1792 alter.exe
Token: SeDebugPrivilege 588

description	pid	process
Token: SeDebugPrivilege	1792	alter.exe
Token: SeDebugPrivilege	588

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exealter.exe

pid	process
1888	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
1888	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
1792	alter.exe
1792	alter.exe

Suspicious use of UnmapMainImage 2 IoCs

Processes:

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exealter.exe

pid process

1888 cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
1792 alter.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe

description	pid	process	target process
PID 1888 wrote to memory of 1792	1888	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe	alter.exe
PID 1888 wrote to memory of 1792	1888	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe	alter.exe
PID 1888 wrote to memory of 1792	1888	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe	alter.exe
PID 1888 wrote to memory of 1792	1888	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe	alter.exe

C:\Users\Admin\AppData\Local\Temp\cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
"C:\Users\Admin\AppData\Local\Temp\cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1888

C:\Users\Admin\AppData\Local\alter.exe
C:\Users\Admin\AppData\Local\Temp\cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
PID:1792

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\alter.exe
Filesize
382KB

MD5
661c5b91f9c04b8b7786ba8879f5f022

SHA1
79d9cc8247d68b169a78fe4d1a18c790619f4e46

SHA256
cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3

SHA512
ac9d1eb65377d6fd9da780ec6190ae64538bffabeebd72fd620c216b9b39c32222c64505e72ab52ea15e8e9439a5f0bd23c5d6dafece8d0b0fda03bcfd6070bc

Download Submit
\Users\Admin\AppData\Local\alter.exe
Filesize
382KB

MD5
661c5b91f9c04b8b7786ba8879f5f022

SHA1
79d9cc8247d68b169a78fe4d1a18c790619f4e46

SHA256
cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3

SHA512
ac9d1eb65377d6fd9da780ec6190ae64538bffabeebd72fd620c216b9b39c32222c64505e72ab52ea15e8e9439a5f0bd23c5d6dafece8d0b0fda03bcfd6070bc

Download Submit
memory/588-65-0x0000000000130000-0x000000000015D000-memory.dmp

Filesize
180KB

Download
memory/588-66-0x0000000000160000-0x0000000000193000-memory.dmp

Filesize
204KB

Download
memory/588-68-0x0000000000160000-0x0000000000193000-memory.dmp

Filesize
204KB

Download
memory/588-69-0x000007FEFB941000-0x000007FEFB943000-memory.dmp

Filesize
8KB

Download
memory/1792-58-0x0000000000000000-mapping.dmp

Download
memory/1792-64-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1792-67-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1888-55-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1888-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/1888-60-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads