d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201

General

Target

d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe
Size

164KB
MD5

6e7333de3ae5da26be72d639358c46de
SHA1

84caeb2e9ad243d0004338887f2f4659f8837c3a
SHA256

d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201
SHA512

b0d5ad549557d07d59a4540f031fcd20c10c9cd094b9f0a1bb015d9d5f9b1519ba4f9dd68c500b521c05cad4f0e42851ee59872567cf148d762494d95ed85afd
SSDEEP

3072:iYthJSqQfBP3DLl7kw0Y1RheL+94EX6/SB5ajWB/GK49NK8P2IuCR0:iWcfJP3Xl7kS1HGi4EX2SB5aSBXCh2A

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 18 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

services.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	services.exe

Modifies security service 2 TTPs 26 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

services.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Type = "32"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\DeleteFlag = "1"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\ErrorControl = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut	services.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1772 cmd.exe

pid	process
1772	cmd.exe

Unexpected DNS network traffic destination 6 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Drops desktop.ini file(s) 2 IoCs

Processes:

services.exe

description ioc process

File created \systemroot\assembly\GAC_64\Desktop.ini services.exe
File created \systemroot\assembly\GAC_32\Desktop.ini services.exe

description	ioc	process
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe

description	pid	process	target process
PID 1424 set thread context of 1772	1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe	cmd.exe

Drops file in Windows directory 1 IoCs

Processes:

d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe

description	ioc	process
File created	C:\Windows\Installer\{d8cbad82-18b4-fba1-f613-11c2aaa4e168}\@	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exeservices.exe

pid	process
1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe
1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe
1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe
1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe
1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe
460	services.exe
1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE

pid	process
1276	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exeservices.exe

description	pid	process
Token: SeDebugPrivilege	1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe
Token: SeDebugPrivilege	1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe
Token: SeDebugPrivilege	1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe
Token: SeDebugPrivilege	460	services.exe
Token: SeBackupPrivilege	460	services.exe
Token: SeRestorePrivilege	460	services.exe
Token: SeSecurityPrivilege	460	services.exe
Token: SeTakeOwnershipPrivilege	460	services.exe
Token: SeBackupPrivilege	460	services.exe
Token: SeRestorePrivilege	460	services.exe
Token: SeSecurityPrivilege	460	services.exe
Token: SeTakeOwnershipPrivilege	460	services.exe
Token: SeBackupPrivilege	460	services.exe
Token: SeRestorePrivilege	460	services.exe
Token: SeSecurityPrivilege	460	services.exe
Token: SeTakeOwnershipPrivilege	460	services.exe
Token: SeBackupPrivilege	460	services.exe
Token: SeRestorePrivilege	460	services.exe
Token: SeSecurityPrivilege	460	services.exe
Token: SeTakeOwnershipPrivilege	460	services.exe
Token: SeBackupPrivilege	460	services.exe
Token: SeRestorePrivilege	460	services.exe
Token: SeSecurityPrivilege	460	services.exe
Token: SeTakeOwnershipPrivilege	460	services.exe
Token: SeBackupPrivilege	460	services.exe
Token: SeRestorePrivilege	460	services.exe
Token: SeSecurityPrivilege	460	services.exe
Token: SeTakeOwnershipPrivilege	460	services.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1276 Explorer.EXE
1276 Explorer.EXE

pid	process
1276	Explorer.EXE
1276	Explorer.EXE

pid	process
1276	Explorer.EXE
1276	Explorer.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe

description	pid	process	target process
PID 1424 wrote to memory of 1276	1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe	Explorer.EXE
PID 1424 wrote to memory of 460	1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe	services.exe
PID 1424 wrote to memory of 1772	1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe	cmd.exe
PID 1424 wrote to memory of 1772	1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe	cmd.exe
PID 1424 wrote to memory of 1772	1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe	cmd.exe
PID 1424 wrote to memory of 1772	1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe	cmd.exe
PID 1424 wrote to memory of 1772	1424	d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe	cmd.exe

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Modifies firewall policy service
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1276

C:\Users\Admin\AppData\Local\Temp\d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe
"C:\Users\Admin\AppData\Local\Temp\d88903a21bfca38b97c38b219d6f6595ee21c7a43f24b4a4ff73af1f8684b201.exe"
2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Deletes itself
PID:1772

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\systemroot\Installer\{d8cbad82-18b4-fba1-f613-11c2aaa4e168}\@

Filesize
2KB

MD5
2a9803e7a603b6f93a5bf9434177928b

SHA1
c63c48e582eb002ee725c0515d966cb71cb26e93

SHA256
b7807764e509bca8f4b93ae2307739797abd8492489aa5897b4a8b39686d5eab

SHA512
6f2981ff4a843f8b9db9e69e607ac29388243a81d1ab846e2f2e96b2c46bfbcdba86d3f976efe2a4ee48370c3cceba17d2cc5f85aaf82dbc9a5968e2327d3534

Download Submit
memory/460-56-0x00000000001B0000-0x00000000001BF000-memory.dmp

Filesize
60KB

Download
memory/460-60-0x00000000001B0000-0x00000000001BF000-memory.dmp

Filesize
60KB

Download
memory/460-64-0x00000000001B0000-0x00000000001BF000-memory.dmp

Filesize
60KB

Download
memory/460-65-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/460-66-0x00000000001C0000-0x00000000001CF000-memory.dmp

Filesize
60KB

Download
memory/460-69-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/1424-55-0x0000000000230000-0x0000000000266000-memory.dmp

Filesize
216KB

Download
memory/1424-54-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1424-67-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1424-71-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1772-70-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads