2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684

General

Target

2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe
Size

132KB
MD5

03138593f14f4104a1616713fc729cd0
SHA1

34ab6f5b85aef918d988580ab95b50f9629ca939
SHA256

2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684
SHA512

0846ab084b6d5f0dd4798bec211cee755f781484c71e07ff3bacb4dad2fa0e6ffc57fe782ba86528fc88d758f22909efef22327424b4c12ef8276412a42a7df5
SSDEEP

1536:/yu68K6k/oouuT3aKFpz5uvfxNu/MQE+Q5OO2sSABw7qrOI+8Sl8l6CZT:KWkgouueNvv5O9zd7qrOI+8wM

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

servicesc.exe

pid process

1656 servicesc.exe

Loads dropped DLL 3 IoCs

Processes:

2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe

pid	process
1112	2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe
1112	2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe
1112	2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

servicesc.exe

pid	process
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe
1656	servicesc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exeservicesc.exe

pid	process
1112	2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe
1112	2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe
1112	2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe
1656	servicesc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe

description	pid	process	target process
PID 1112 wrote to memory of 1656	1112	2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe	servicesc.exe
PID 1112 wrote to memory of 1656	1112	2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe	servicesc.exe
PID 1112 wrote to memory of 1656	1112	2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe	servicesc.exe
PID 1112 wrote to memory of 1656	1112	2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe	servicesc.exe

C:\Users\Admin\AppData\Local\Temp\2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe
"C:\Users\Admin\AppData\Local\Temp\2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe"
1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1112

C:\Users\Admin\AppData\Local\Temp\servicesc.exe
C:\Users\Admin\AppData\Local\Temp\servicesc.exe 2d000403e6698589ea3c8957f3525055cc2a9b17cf9c70cf32afa4a0321be684.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\servicesc.exe

Filesize
32KB

MD5
564b45c7bf27eabd55cdfbde14f81e09

SHA1
e69b69b1b69f7d6333af8500792bc378b15ace5a

SHA256
5fe1e869c881aad786f1ca044faa2b57a6f0505b0b2892daf8d1837eeae99ac2

SHA512
043037525904987eb6ddd06d0adce933eea3aaeda9797ca8636af419dbe820c122960d47f14076c7b7f1ff61f29774c90f454e14025090643cc6b41271c579ed

Download Submit
\Users\Admin\AppData\Local\Temp\csh.dll

Filesize
68KB

MD5
8b8e53a924e28feb6a014b17910f5800

SHA1
3da6912715efb0268e4e886949c8ad55e41acdcb

SHA256
19fde3fb9e6b0282555ff6f4f99da8ad1294e10b115d4c925c22147a8ea17b00

SHA512
36f94c032765af4f764ca6ada3b56a61f8466166d38505461efb5f17bb3f6bd4adfde9a990db64c53d488fe75df26a0e1d528fa9eee2010f05e20d97ece00f7d

Download Submit
\Users\Admin\AppData\Local\Temp\servicesc.exe

Filesize
32KB

MD5
564b45c7bf27eabd55cdfbde14f81e09

SHA1
e69b69b1b69f7d6333af8500792bc378b15ace5a

SHA256
5fe1e869c881aad786f1ca044faa2b57a6f0505b0b2892daf8d1837eeae99ac2

SHA512
043037525904987eb6ddd06d0adce933eea3aaeda9797ca8636af419dbe820c122960d47f14076c7b7f1ff61f29774c90f454e14025090643cc6b41271c579ed

Download Submit
\Users\Admin\AppData\Local\Temp\servicesc.exe

Filesize
32KB

MD5
564b45c7bf27eabd55cdfbde14f81e09

SHA1
e69b69b1b69f7d6333af8500792bc378b15ace5a

SHA256
5fe1e869c881aad786f1ca044faa2b57a6f0505b0b2892daf8d1837eeae99ac2

SHA512
043037525904987eb6ddd06d0adce933eea3aaeda9797ca8636af419dbe820c122960d47f14076c7b7f1ff61f29774c90f454e14025090643cc6b41271c579ed

Download Submit
memory/1112-56-0x0000000074D61000-0x0000000074D63000-memory.dmp

Filesize
8KB

Download
memory/1112-64-0x0000000003D21000-0x0000000004BCD000-memory.dmp

Filesize
14.7MB

Download
memory/1656-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads