7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00

General

Target

7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
Size

412KB
MD5

d64c9c4a1aa1e7d55fe99dcea666ed8a
SHA1

34e69e9505248dd5e5aa341ca2c53c99919101cf
SHA256

7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00
SHA512

bfdbe9476e00ecd0710eaf6f7d7962766aaf1a6aae866ee745b19153a8e8a16a509b165b374bf4aac84a98b80714297acd5bd6d6892e6826be691e3deb038bfb
SSDEEP

3072:jewPM5OCaV0RwUeiddL7oDBgfu6yQCq9vXonANArMah8z8Vxoatl:j6548Jeaolk9Cqto7ML8V2at

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
560	iTunes.exe
1588	iTunes.exe

Loads dropped DLL 2 IoCs

pid	Process
2024	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
2024	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Apple iPod Service = "C:\\Users\\Admin\\AppData\\Roaming\\iTunes.exe"	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1428 set thread context of 2024	1428	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	28
PID 560 set thread context of 1588	560	iTunes.exe	30

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2024	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
Token: SeIncBasePriorityPrivilege	2024	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
Token: 33	1588	iTunes.exe
Token: SeIncBasePriorityPrivilege	1588	iTunes.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1428	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
560	iTunes.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2024	1428	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	28
PID 1428 wrote to memory of 2024	1428	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	28
PID 1428 wrote to memory of 2024	1428	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	28
PID 1428 wrote to memory of 2024	1428	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	28
PID 1428 wrote to memory of 2024	1428	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	28
PID 1428 wrote to memory of 2024	1428	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	28
PID 1428 wrote to memory of 2024	1428	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	28
PID 1428 wrote to memory of 2024	1428	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	28
PID 1428 wrote to memory of 2024	1428	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	28
PID 2024 wrote to memory of 560	2024	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	29
PID 2024 wrote to memory of 560	2024	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	29
PID 2024 wrote to memory of 560	2024	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	29
PID 2024 wrote to memory of 560	2024	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	29
PID 560 wrote to memory of 1588	560	iTunes.exe	30
PID 560 wrote to memory of 1588	560	iTunes.exe	30
PID 560 wrote to memory of 1588	560	iTunes.exe	30
PID 560 wrote to memory of 1588	560	iTunes.exe	30
PID 560 wrote to memory of 1588	560	iTunes.exe	30
PID 560 wrote to memory of 1588	560	iTunes.exe	30
PID 560 wrote to memory of 1588	560	iTunes.exe	30
PID 560 wrote to memory of 1588	560	iTunes.exe	30
PID 560 wrote to memory of 1588	560	iTunes.exe	30

C:\Users\Admin\AppData\Local\Temp\7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
"C:\Users\Admin\AppData\Local\Temp\7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
  "C:\Users\Admin\AppData\Local\Temp\7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Users\Admin\AppData\Roaming\iTunes.exe
    "C:\Users\Admin\AppData\Roaming\iTunes.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:560
  - - C:\Users\Admin\AppData\Roaming\iTunes.exe
      "C:\Users\Admin\AppData\Roaming\iTunes.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\iTunes.exe

Filesize
412KB

MD5
d64c9c4a1aa1e7d55fe99dcea666ed8a

SHA1
34e69e9505248dd5e5aa341ca2c53c99919101cf

SHA256
7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00

SHA512
bfdbe9476e00ecd0710eaf6f7d7962766aaf1a6aae866ee745b19153a8e8a16a509b165b374bf4aac84a98b80714297acd5bd6d6892e6826be691e3deb038bfb

Download Submit
C:\Users\Admin\AppData\Roaming\iTunes.exe

Filesize
412KB

MD5
d64c9c4a1aa1e7d55fe99dcea666ed8a

SHA1
34e69e9505248dd5e5aa341ca2c53c99919101cf

SHA256
7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00

SHA512
bfdbe9476e00ecd0710eaf6f7d7962766aaf1a6aae866ee745b19153a8e8a16a509b165b374bf4aac84a98b80714297acd5bd6d6892e6826be691e3deb038bfb

Download Submit
C:\Users\Admin\AppData\Roaming\iTunes.exe

Filesize
412KB

MD5
d64c9c4a1aa1e7d55fe99dcea666ed8a

SHA1
34e69e9505248dd5e5aa341ca2c53c99919101cf

SHA256
7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00

SHA512
bfdbe9476e00ecd0710eaf6f7d7962766aaf1a6aae866ee745b19153a8e8a16a509b165b374bf4aac84a98b80714297acd5bd6d6892e6826be691e3deb038bfb

Download Submit
\Users\Admin\AppData\Roaming\iTunes.exe

Filesize
412KB

MD5
d64c9c4a1aa1e7d55fe99dcea666ed8a

SHA1
34e69e9505248dd5e5aa341ca2c53c99919101cf

SHA256
7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00

SHA512
bfdbe9476e00ecd0710eaf6f7d7962766aaf1a6aae866ee745b19153a8e8a16a509b165b374bf4aac84a98b80714297acd5bd6d6892e6826be691e3deb038bfb

Download Submit
\Users\Admin\AppData\Roaming\iTunes.exe

Filesize
412KB

MD5
d64c9c4a1aa1e7d55fe99dcea666ed8a

SHA1
34e69e9505248dd5e5aa341ca2c53c99919101cf

SHA256
7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00

SHA512
bfdbe9476e00ecd0710eaf6f7d7962766aaf1a6aae866ee745b19153a8e8a16a509b165b374bf4aac84a98b80714297acd5bd6d6892e6826be691e3deb038bfb

Download Submit
memory/1588-93-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/1588-92-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/1588-91-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/2024-75-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/2024-56-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/2024-61-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/2024-76-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/2024-59-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/2024-63-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/2024-57-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/2024-68-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/2024-67-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/2024-64-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing