237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f

General

Target

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
Size

96KB
MD5

92beaf950cb1bded13ba36b770ef7f91
SHA1

4e741a8789569f7b6fc9ff1cce603bb9c797fc22
SHA256

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f
SHA512

9e7da62b22c66dd2e51bab93a6dbe0c0576b4cb276ef5fe849270349fcb9afbe7db2d83dff1798e9046e80c73ec6e9453e505dab7ee8ed829894e4d7925d6675
SSDEEP

1536:RFEdNmSNF1ZVNoh4I545MQ5MSe+dMHPNY5Z8TpyVf94nn2FC9:IdNJNSF+iSlMY5mTp4f902g

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

regedit.exe

pid process

1736 regedit.exe
Sets service image path in registry 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

regedit.exe

description ioc process

Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\HideKey\ImagePath = "\\??\\c:\\recycler\\hidekey.txt" regedit.exe
Drops file in Windows directory 1 IoCs

Processes:

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

description ioc process

File opened for modification C:\Windows\update.log 237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exeipconfig.exe

pid process

4496 ipconfig.exe
2244 ipconfig.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

1736 regedit.exe

pid	process
1736	regedit.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\HideKey\ImagePath = "\\??\\c:\\recycler\\hidekey.txt"	regedit.exe

description	ioc	process
File opened for modification	C:\Windows\update.log	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

pid	process
4496	ipconfig.exe
2244	ipconfig.exe

pid	process
1736	regedit.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

pid	process
540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

description	pid	process
Token: SeDebugPrivilege	540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
Token: SeDebugPrivilege	540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe

description	pid	process	target process
PID 540 wrote to memory of 4496	540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 540 wrote to memory of 4496	540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 540 wrote to memory of 4496	540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 540 wrote to memory of 1736	540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	regedit.exe
PID 540 wrote to memory of 1736	540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	regedit.exe
PID 540 wrote to memory of 1736	540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	regedit.exe
PID 540 wrote to memory of 1540	540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
PID 540 wrote to memory of 1540	540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
PID 540 wrote to memory of 1540	540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
PID 1540 wrote to memory of 2244	1540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 1540 wrote to memory of 2244	1540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe
PID 1540 wrote to memory of 2244	1540	237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe	ipconfig.exe

C:\Users\Admin\AppData\Local\Temp\237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
"C:\Users\Admin\AppData\Local\Temp\237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:540

C:\Windows\SysWOW64\ipconfig.exe
ipconfig.exe
2⤵
- Gathers network information
PID:4496

\??\c:\recycler\regedit.exe
c:\recycler\regedit.exe /s c:\recycler\hidekey.reg
2⤵
- Executes dropped EXE
- Sets service image path in registry
- Runs .reg file with regedit
PID:1736

C:\Users\Admin\AppData\Local\Temp\237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
C:\Users\Admin\AppData\Local\Temp\237c5881b8ef6089a45f9bdd75a6a1e5aae977ac3e713c6676a508cdca5d591f.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\ipconfig.exe
ipconfig.exe
3⤵
- Gathers network information
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1540 -ip 1540
1⤵
PID:3464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\recycler\regedit.exe

Filesize
322KB

MD5
bd63d72db4fa96a1e0250b1d36b7a827

SHA1
aad4b770b25789b7acd508bf3cf266d4ddb88111

SHA256
f6953923fa9537edd709488db8fc17c7991f4f053a904306d9b93d79391fb0e6

SHA512
e68b7a255cd22dcb885a094c24e8fe2c86cd8d1014aa0064917d33dee96c345fda594baad6d86ec087a2b167cad9936624aadd5b4953337a4a39e79ca88f8f3c

Download Submit
\??\c:\recycler\hidekey.reg

Filesize
766B

MD5
35422736785393dfbb664197985be1ef

SHA1
34c3bb7eab71180ad61eeb2479f0c0e091d950e1

SHA256
61e38d68bbe45bbe65aa18c1838dc482697d752c16f159b262ffb56bef26d665

SHA512
d8add2ddc0fbdbae0c4ac72f2f4b3351c3852e962f0745abe566e86977eb265dc16b21b251120e048e8a2cc8053564a78346059d93c4444cd904f5154bd89c34

Download Submit
memory/1540-136-0x0000000000000000-mapping.dmp

Download
memory/1736-133-0x0000000000000000-mapping.dmp

Download
memory/2244-137-0x0000000000000000-mapping.dmp

Download
memory/4496-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads