237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f

General

Target

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
Size

96KB
MD5

92beaf950cb1bded13ba36b770ef7f91
SHA1

4e741a8789569f7b6fc9ff1cce603bb9c797fc22
SHA256

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f
SHA512

9e7da62b22c66dd2e51bab93a6dbe0c0576b4cb276ef5fe849270349fcb9afbe7db2d83dff1798e9046e80c73ec6e9453e505dab7ee8ed829894e4d7925d6675
SSDEEP

1536:RFEdNmSNF1ZVNoh4I545MQ5MSe+dMHPNY5Z8TpyVf94nn2FC9:IdNJNSF+iSlMY5mTp4f902g

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

regedit.exe

pid process

1656 regedit.exe
Sets service image path in registry 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

regedit.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\HideKey\ImagePath = "\\??\\c:\\recycler\\hidekey.txt" regedit.exe
Loads dropped DLL 1 IoCs

Processes:

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

pid process

1404 237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
Drops file in Windows directory 1 IoCs

Processes:

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

description ioc process

File opened for modification C:\Windows\update.log 237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

1956 ipconfig.exe
1552 ipconfig.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1656 regedit.exe

pid	process
1656	regedit.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\HideKey\ImagePath = "\\??\\c:\\recycler\\hidekey.txt"	regedit.exe

description	ioc	process
File opened for modification	C:\Windows\update.log	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

pid	process
1956	ipconfig.exe
1552	ipconfig.exe

pid	process
1656	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

pid	process
1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

description	pid	process
Token: SeDebugPrivilege	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
Token: SeDebugPrivilege	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

description	pid	process	target process
PID 1404 wrote to memory of 1956	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 1404 wrote to memory of 1956	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 1404 wrote to memory of 1956	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 1404 wrote to memory of 1956	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 1404 wrote to memory of 1656	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	regedit.exe
PID 1404 wrote to memory of 1656	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	regedit.exe
PID 1404 wrote to memory of 1656	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	regedit.exe
PID 1404 wrote to memory of 1656	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	regedit.exe
PID 1404 wrote to memory of 1340	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
PID 1404 wrote to memory of 1340	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
PID 1404 wrote to memory of 1340	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
PID 1404 wrote to memory of 1340	1404	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
PID 1340 wrote to memory of 1552	1340	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 1340 wrote to memory of 1552	1340	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 1340 wrote to memory of 1552	1340	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 1340 wrote to memory of 1552	1340	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
"C:\Users\Admin\AppData\Local\Temp\237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404

C:\Windows\SysWOW64\ipconfig.exe
ipconfig.exe
2⤵
- Gathers network information
PID:1956

\??\c:\recycler\regedit.exe
c:\recycler\regedit.exe /s c:\recycler\hidekey.reg
2⤵
- Executes dropped EXE
- Sets service image path in registry
- Runs .reg file with regedit
PID:1656

C:\Users\Admin\AppData\Local\Temp\237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
C:\Users\Admin\AppData\Local\Temp\237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\ipconfig.exe
ipconfig.exe
3⤵
- Gathers network information
PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\recycler\regedit.exe

Filesize
389KB

MD5
8a4883f5e7ac37444f23279239553878

SHA1
682214961228453c389854e81e6786df92bbfa67

SHA256
f318c94a46dbca88eefc3e28be51d27e5f91029dc062f56faaa995f0b5f8e518

SHA512
7f51e5278aaa5babfa8eb48fc414bf985775b39e1a94b84faffd995e82781dec87c54945edc6ae7570810c646f9f50256713d96ee7c4197a82a30e51145baa4a

Download Submit
\??\c:\recycler\hidekey.reg

Filesize
766B

MD5
35422736785393dfbb664197985be1ef

SHA1
34c3bb7eab71180ad61eeb2479f0c0e091d950e1

SHA256
61e38d68bbe45bbe65aa18c1838dc482697d752c16f159b262ffb56bef26d665

SHA512
d8add2ddc0fbdbae0c4ac72f2f4b3351c3852e962f0745abe566e86977eb265dc16b21b251120e048e8a2cc8053564a78346059d93c4444cd904f5154bd89c34

Download Submit
\recycler\regedit.exe

Filesize
389KB

MD5
8a4883f5e7ac37444f23279239553878

SHA1
682214961228453c389854e81e6786df92bbfa67

SHA256
f318c94a46dbca88eefc3e28be51d27e5f91029dc062f56faaa995f0b5f8e518

SHA512
7f51e5278aaa5babfa8eb48fc414bf985775b39e1a94b84faffd995e82781dec87c54945edc6ae7570810c646f9f50256713d96ee7c4197a82a30e51145baa4a

Download Submit
memory/1340-61-0x0000000000000000-mapping.dmp

Download
memory/1552-62-0x0000000000000000-mapping.dmp

Download
memory/1656-56-0x0000000000000000-mapping.dmp

Download
memory/1956-54-0x0000000000000000-mapping.dmp

Download
memory/1956-58-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads