b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671

General

Target

b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exe
Size

443KB
MD5

0d5ad9759753cb4639cd405eddbe2a16
SHA1

59ebd6f375075bf3581ab07d0a59109ca6846085
SHA256

b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671
SHA512

e586921c4eaee8fc16fecc04a6dec4aab3982773d77c0622363a9d844cbcafc2ad7339f5ea47af3e7a4b68d44c23c72ad1d03e4462d0bb17e6a7be36076f20df
SSDEEP

12288:CO9/kQthsWG/BXYEBZOXxN5PjF7n5KyB4hebXfdRLAwVOlRR5mHw1kFGnnuQbsBm:CO9/kQthsWG/BXYEBZOXxN5PjF7n5Ky2

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

alter.exe

pid process

792 alter.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

alter.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Software\Microsoft\Windows\CurrentVersion\Run	alter.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\alter.exe"	alter.exe

Drops file in System32 directory 2 IoCs

Processes:

description	ioc	process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\whr458da.db
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\whr458da.db

Drops file in Windows directory 2 IoCs

Processes:

b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exealter.exe

description	ioc	process
File opened for modification	C:\Windows\b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.INI	b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exe
File opened for modification	C:\Windows\alter.INI	alter.exe

Modifies data under HKEY_USERS 8 IoCs

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

alter.exe

pid	process
792	alter.exe
792	alter.exe
792	alter.exe
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772
772

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

alter.exe

pid process

792 alter.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

alter.exe

description pid process

Token: SeDebugPrivilege 792 alter.exe
Token: SeDebugPrivilege 772

description	pid	process
Token: SeDebugPrivilege	792	alter.exe
Token: SeDebugPrivilege	772

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exealter.exe

pid	process
4992	b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exe
4992	b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exe
792	alter.exe
792	alter.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exe

description	pid	process	target process
PID 4992 wrote to memory of 792	4992	b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exe	alter.exe
PID 4992 wrote to memory of 792	4992	b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exe	alter.exe
PID 4992 wrote to memory of 792	4992	b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exe	alter.exe
PID 772 wrote to memory of 2976	772		wmiprvse.exe
PID 772 wrote to memory of 2976	772		wmiprvse.exe

C:\Users\Admin\AppData\Local\Temp\b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exe
"C:\Users\Admin\AppData\Local\Temp\b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Users\Admin\AppData\Local\alter.exe
  C:\Users\Admin\AppData\Local\Temp\b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:792

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\alter.exe

Filesize
443KB

MD5
0d5ad9759753cb4639cd405eddbe2a16

SHA1
59ebd6f375075bf3581ab07d0a59109ca6846085

SHA256
b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671

SHA512
e586921c4eaee8fc16fecc04a6dec4aab3982773d77c0622363a9d844cbcafc2ad7339f5ea47af3e7a4b68d44c23c72ad1d03e4462d0bb17e6a7be36076f20df

Download Submit
C:\Users\Admin\AppData\Local\alter.exe

Filesize
443KB

MD5
0d5ad9759753cb4639cd405eddbe2a16

SHA1
59ebd6f375075bf3581ab07d0a59109ca6846085

SHA256
b10812fc64d6957a08de37285136741e2227c433aca1cb9c5299deffba92f671

SHA512
e586921c4eaee8fc16fecc04a6dec4aab3982773d77c0622363a9d844cbcafc2ad7339f5ea47af3e7a4b68d44c23c72ad1d03e4462d0bb17e6a7be36076f20df

Download Submit
memory/772-141-0x000002CEF32C0000-0x000002CEF32ED000-memory.dmp

Filesize
180KB

Download
memory/772-142-0x000002CEF32F0000-0x000002CEF3323000-memory.dmp

Filesize
204KB

Download
memory/792-134-0x0000000000000000-mapping.dmp

Download
memory/792-140-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/792-144-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2976-143-0x0000000000000000-mapping.dmp

Download
memory/4992-132-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/4992-137-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads