7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00

General

Target

7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
Size

412KB
MD5

d64c9c4a1aa1e7d55fe99dcea666ed8a
SHA1

34e69e9505248dd5e5aa341ca2c53c99919101cf
SHA256

7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00
SHA512

bfdbe9476e00ecd0710eaf6f7d7962766aaf1a6aae866ee745b19153a8e8a16a509b165b374bf4aac84a98b80714297acd5bd6d6892e6826be691e3deb038bfb
SSDEEP

3072:jewPM5OCaV0RwUeiddL7oDBgfu6yQCq9vXonANArMah8z8Vxoatl:j6548Jeaolk9Cqto7ML8V2at

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3924	iTunes.exe
1484	iTunes.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Apple iPod Service = "C:\\Users\\Admin\\AppData\\Roaming\\iTunes.exe"	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4996 set thread context of 1224	4996	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	81
PID 3924 set thread context of 1484	3924	iTunes.exe	83

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	1224	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
Token: SeIncBasePriorityPrivilege	1224	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
Token: 33	1484	iTunes.exe
Token: SeIncBasePriorityPrivilege	1484	iTunes.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4996	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
3924	iTunes.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 1224	4996	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	81
PID 4996 wrote to memory of 1224	4996	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	81
PID 4996 wrote to memory of 1224	4996	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	81
PID 4996 wrote to memory of 1224	4996	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	81
PID 4996 wrote to memory of 1224	4996	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	81
PID 4996 wrote to memory of 1224	4996	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	81
PID 4996 wrote to memory of 1224	4996	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	81
PID 4996 wrote to memory of 1224	4996	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	81
PID 1224 wrote to memory of 3924	1224	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	82
PID 1224 wrote to memory of 3924	1224	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	82
PID 1224 wrote to memory of 3924	1224	7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe	82
PID 3924 wrote to memory of 1484	3924	iTunes.exe	83
PID 3924 wrote to memory of 1484	3924	iTunes.exe	83
PID 3924 wrote to memory of 1484	3924	iTunes.exe	83
PID 3924 wrote to memory of 1484	3924	iTunes.exe	83
PID 3924 wrote to memory of 1484	3924	iTunes.exe	83
PID 3924 wrote to memory of 1484	3924	iTunes.exe	83
PID 3924 wrote to memory of 1484	3924	iTunes.exe	83
PID 3924 wrote to memory of 1484	3924	iTunes.exe	83

C:\Users\Admin\AppData\Local\Temp\7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
"C:\Users\Admin\AppData\Local\Temp\7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe
  "C:\Users\Admin\AppData\Local\Temp\7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Users\Admin\AppData\Roaming\iTunes.exe
    "C:\Users\Admin\AppData\Roaming\iTunes.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Users\Admin\AppData\Roaming\iTunes.exe
      "C:\Users\Admin\AppData\Roaming\iTunes.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\iTunes.exe

Filesize
412KB

MD5
d64c9c4a1aa1e7d55fe99dcea666ed8a

SHA1
34e69e9505248dd5e5aa341ca2c53c99919101cf

SHA256
7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00

SHA512
bfdbe9476e00ecd0710eaf6f7d7962766aaf1a6aae866ee745b19153a8e8a16a509b165b374bf4aac84a98b80714297acd5bd6d6892e6826be691e3deb038bfb

Download Submit
C:\Users\Admin\AppData\Roaming\iTunes.exe

Filesize
412KB

MD5
d64c9c4a1aa1e7d55fe99dcea666ed8a

SHA1
34e69e9505248dd5e5aa341ca2c53c99919101cf

SHA256
7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00

SHA512
bfdbe9476e00ecd0710eaf6f7d7962766aaf1a6aae866ee745b19153a8e8a16a509b165b374bf4aac84a98b80714297acd5bd6d6892e6826be691e3deb038bfb

Download Submit
C:\Users\Admin\AppData\Roaming\iTunes.exe

Filesize
412KB

MD5
d64c9c4a1aa1e7d55fe99dcea666ed8a

SHA1
34e69e9505248dd5e5aa341ca2c53c99919101cf

SHA256
7317ed1501b26fad65ebd7c24608f6f5cbcfe966fd462f9c4ecc75ba45e16b00

SHA512
bfdbe9476e00ecd0710eaf6f7d7962766aaf1a6aae866ee745b19153a8e8a16a509b165b374bf4aac84a98b80714297acd5bd6d6892e6826be691e3deb038bfb

Download Submit
memory/1224-135-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/1224-137-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/1224-143-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/1484-148-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/1484-149-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download
memory/1484-150-0x0000000000400000-0x0000000000903000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing