cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3

General

Target

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
Size

382KB
MD5

661c5b91f9c04b8b7786ba8879f5f022
SHA1

79d9cc8247d68b169a78fe4d1a18c790619f4e46
SHA256

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3
SHA512

ac9d1eb65377d6fd9da780ec6190ae64538bffabeebd72fd620c216b9b39c32222c64505e72ab52ea15e8e9439a5f0bd23c5d6dafece8d0b0fda03bcfd6070bc
SSDEEP

6144:6byYQvVfG6dg882DVaYq4sMPPEUygjzn8eIzgjIE3k57A4FP:6FeNBgpgVaYlsTy8nEkGss4FP

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

alter.exe

pid process

3444 alter.exe

pid	process
3444	alter.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

alter.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Software\Microsoft\Windows\CurrentVersion\Run	alter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\alter.exe"	alter.exe

Drops file in System32 directory 2 IoCs

Processes:

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\whr458da.db
File created	C:\Windows\system32\config\systemprofile\AppData\Local\whr458da.db

Drops file in Windows directory 2 IoCs

Processes:

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exealter.exe

description	ioc	process
File opened for modification	C:\Windows\cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.INI	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
File opened for modification	C:\Windows\alter.INI	alter.exe

Modifies registry class 15 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\ICT = "133126515190731061"
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133136827611056830"
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133136828643429044"
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.Search_cw5n1h2txyewy\HAM\AUI\CortanaUI\V1\LU\PCT = "133126515188856581"
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU
Set value (int)	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133136828825459919"

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

alter.exe

pid process

3444 alter.exe
3444 alter.exe
3444 alter.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

alter.exe

pid process

3444 alter.exe

pid	process
3444	alter.exe
3444	alter.exe
3444	alter.exe

pid	process
3444	alter.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

alter.exe

description	pid	process
Token: SeDebugPrivilege	3444	alter.exe
Token: SeDebugPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788
Token: SeTcbPrivilege	788

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exealter.exe

pid	process
1516	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
1516	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
3444	alter.exe
3444	alter.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe

description	pid	process	target process
PID 1516 wrote to memory of 3444	1516	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe	alter.exe
PID 1516 wrote to memory of 3444	1516	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe	alter.exe
PID 1516 wrote to memory of 3444	1516	cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe	alter.exe
PID 788 wrote to memory of 3272	788		backgroundTaskHost.exe
PID 788 wrote to memory of 3272	788		backgroundTaskHost.exe
PID 788 wrote to memory of 3272	788		backgroundTaskHost.exe
PID 788 wrote to memory of 976	788		mousocoreworker.exe
PID 788 wrote to memory of 976	788		mousocoreworker.exe

C:\Users\Admin\AppData\Local\Temp\cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
"C:\Users\Admin\AppData\Local\Temp\cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1516

C:\Users\Admin\AppData\Local\alter.exe
C:\Users\Admin\AppData\Local\Temp\cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3444

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3272

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\alter.exe

Filesize
382KB

MD5
661c5b91f9c04b8b7786ba8879f5f022

SHA1
79d9cc8247d68b169a78fe4d1a18c790619f4e46

SHA256
cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3

SHA512
ac9d1eb65377d6fd9da780ec6190ae64538bffabeebd72fd620c216b9b39c32222c64505e72ab52ea15e8e9439a5f0bd23c5d6dafece8d0b0fda03bcfd6070bc

Download Submit
C:\Users\Admin\AppData\Local\alter.exe

Filesize
382KB

MD5
661c5b91f9c04b8b7786ba8879f5f022

SHA1
79d9cc8247d68b169a78fe4d1a18c790619f4e46

SHA256
cab8ac367017805bb701b547f8672d4447c26a4f8462ff5a1ce18dfc110028c3

SHA512
ac9d1eb65377d6fd9da780ec6190ae64538bffabeebd72fd620c216b9b39c32222c64505e72ab52ea15e8e9439a5f0bd23c5d6dafece8d0b0fda03bcfd6070bc

Download Submit
memory/788-141-0x00000239BD700000-0x00000239BD72D000-memory.dmp

Filesize
180KB

Download
memory/788-142-0x00000239BD730000-0x00000239BD763000-memory.dmp

Filesize
204KB

Download
memory/788-144-0x00000239BD730000-0x00000239BD763000-memory.dmp

Filesize
204KB

Download
memory/976-146-0x0000000000000000-mapping.dmp

Download
memory/1516-132-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/1516-137-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/3272-145-0x0000000000000000-mapping.dmp

Download
memory/3444-134-0x0000000000000000-mapping.dmp

Download
memory/3444-140-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3444-143-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads