c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7

General

Target

c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
Size

847KB
MD5

ac10de18148cf893db362b340801139b
SHA1

45887be5c4203466c2db5a45fc0646420739119f
SHA256

c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7
SHA512

9cb08e60ad587647c5928d269101d209c354af2432bb70f443f95583a4141e15909fd1aef5590b08a94192fd9b18cc72f9491c50d015621302694efa377e0da6
SSDEEP

12288:jyUjD5wyUjD5SV5KV5izrqFkb7yUjD5wyUjD5SV5KV5izrqFkbrsAAh6NAt/BI/m:3IifqFuvIifqFuQqN/JWSVW7

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe

Drops file in Program Files directory 64 IoCs

Processes:

c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\jcmd.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\javaws.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\servertool.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\kinit.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\rmiregistry.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\servertool.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\tnameserv.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\ssvagent.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpshare.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\schemagen.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\rmiregistry.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\keytool.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleCrashHandler.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoia.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.167.21\MicrosoftEdgeComRegisterShellARM64.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.71\GoogleUpdateOnDemand.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\jjs.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jdeps.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\wsimport.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\java.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe$	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe

NTFS ADS 1 IoCs

Processes:

c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe

pid process

3668 c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe

pid	process
3668	c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe

C:\Users\Admin\AppData\Local\Temp\c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe
"C:\Users\Admin\AppData\Local\Temp\c5db6b4fa4cc37e3b38f4cbd6e0ee98d1d41b7f98093cf575dbc2259b60f3ec7.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3668