5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7

General

Target

5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe
Size

985KB
MD5

04a905e66258bd7308c554f2d0d9b501
SHA1

6c3baa9f3a20a04e66b8ff9b9e683e051d238ad6
SHA256

5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7
SHA512

bdf7fe2c9bfdc93db022ccc34027d248b290cd5b948cad1d528b5ee3bbf19a8caa272373801e4a5f6f1e3a7f6a31df4845d49d401f8fa82cae4c60e670c2ccee
SSDEEP

12288:OZ4TDDmNOzKnDAWo1s5MV6VIzqzFIIhIIODAWo1s5MV6VIzqzFIIhII8DAWo1s5P:5/qsKUJ1sagasJ1sagaqJ1saga

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe

Executes dropped EXE 1 IoCs

pid	Process
1216	F38D4D916A44F665.TMP

Loads dropped DLL 2 IoCs

pid	Process
1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe
1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FrameWork = "C:\\Windows\\system32\\WinMain.exe 6666"	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinMain.exe	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe
File opened for modification	C:\Windows\SysWOW64\WinMain.exe	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	904	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1216	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	28
PID 1104 wrote to memory of 1216	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	28
PID 1104 wrote to memory of 1216	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	28
PID 1104 wrote to memory of 1216	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	28
PID 1104 wrote to memory of 944	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	29
PID 1104 wrote to memory of 944	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	29
PID 1104 wrote to memory of 944	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	29
PID 1104 wrote to memory of 944	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	29
PID 1104 wrote to memory of 904	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	30
PID 1104 wrote to memory of 904	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	30
PID 1104 wrote to memory of 904	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	30
PID 1104 wrote to memory of 904	1104	5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe	30

C:\Users\Admin\AppData\Local\Temp\5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe
"C:\Users\Admin\AppData\Local\Temp\5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\F38D4D916A44F665.TMP
  "C:\Users\Admin\AppData\Local\Temp\F38D4D916A44F665.TMP"
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Users\Admin\AppData\Local\Temp\5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe
  7777
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Adds Run key to start application
  - Drops file in System32 directory
  PID:944
- C:\Users\Admin\AppData\Local\Temp\5e6fc8592e0ce121db79b1a61b854728798aa924683fe6f5d0ed3e491d19b0a7.exe
  9999
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:904

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\F38D4D916A44F665.TMP

Filesize
10KB

MD5
5b50d0284158d546cf2d8784409159d1

SHA1
8f0de8080551d2146db87d82e0affbc65fe2d57d

SHA256
99d2ce22196d749bb316b74e05ff162a429e3888e6afa19d9607548c02af3eed

SHA512
c5ed95ba41f0eaf8c43415e2a608f5014af90a644a247ec789ed1b177e26e3bfff95737d62afe12f0991f608c1a8da98b146163678340517fa871eb8ecff7f5a

Download Submit
\Users\Admin\AppData\Local\Temp\F38D4D916A44F665.TMP

Filesize
10KB

MD5
5b50d0284158d546cf2d8784409159d1

SHA1
8f0de8080551d2146db87d82e0affbc65fe2d57d

SHA256
99d2ce22196d749bb316b74e05ff162a429e3888e6afa19d9607548c02af3eed

SHA512
c5ed95ba41f0eaf8c43415e2a608f5014af90a644a247ec789ed1b177e26e3bfff95737d62afe12f0991f608c1a8da98b146163678340517fa871eb8ecff7f5a

Download Submit
\Users\Admin\AppData\Local\Temp\F38D4D916A44F665.TMP

Filesize
10KB

MD5
5b50d0284158d546cf2d8784409159d1

SHA1
8f0de8080551d2146db87d82e0affbc65fe2d57d

SHA256
99d2ce22196d749bb316b74e05ff162a429e3888e6afa19d9607548c02af3eed

SHA512
c5ed95ba41f0eaf8c43415e2a608f5014af90a644a247ec789ed1b177e26e3bfff95737d62afe12f0991f608c1a8da98b146163678340517fa871eb8ecff7f5a

Download Submit
memory/904-60-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/944-61-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1104-63-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1104-64-0x0000000000390000-0x00000000003F7000-memory.dmp

Filesize
412KB

Download
memory/1104-65-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1216-62-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads