88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196

General

Target

88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe
Size

716KB
MD5

ea9ab0d64e6648f9feee920ae60f1c0e
SHA1

2af19e6bebcf278687c4f797bf0ecb9ff84ec2b4
SHA256

88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196
SHA512

9d0399a46df102c8cffd4c60f8a4d78dd7c86d04b454f8b921a971af3085556789592be47e2b4c25be5b5598c702e2b403778017fd8343bd7bbefab8bc9e2ac5
SSDEEP

12288:jRyTSktU4g/n/t0EW5A0zyYvJwQ5oAlK+GE4vebIk6bQQ52LgRg08y5HpnK9V:dStU4gf2EW5A2DJr/kS4vGIk6v3Hg

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

svhost.exe

pid process

944 svhost.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1048 cmd.exe

pid	process
944	svhost.exe

pid	process
1048	cmd.exe

Drops file in System32 directory 1 IoCs

Processes:

svhost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svhost.exe

Drops file in Program Files directory 2 IoCs

Processes:

88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe

description	ioc	process
File created	C:\Program Files (x86)\svhost.exe	88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe
File opened for modification	C:\Program Files (x86)\svhost.exe	88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe

Drops file in Windows directory 1 IoCs

Processes:

88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe

description ioc process

File created C:\Windows\uninstal.bat 88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe

description	ioc	process
File created	C:\Windows\uninstal.bat	88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

svhost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0151FDCC-8788-4581-A13B-EE69F7E29F22}\22-35-6e-97-c0-55	svhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-35-6e-97-c0-55\WpadDecision = "0"	svhost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f003f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svhost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0151FDCC-8788-4581-A13B-EE69F7E29F22}	svhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0151FDCC-8788-4581-A13B-EE69F7E29F22}\WpadDecisionTime = 40c6b5c9e0ffd801	svhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0151FDCC-8788-4581-A13B-EE69F7E29F22}\WpadDecision = "0"	svhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0151FDCC-8788-4581-A13B-EE69F7E29F22}\WpadDecisionReason = "1"	svhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-35-6e-97-c0-55\WpadDecisionTime = 40c6b5c9e0ffd801	svhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0151FDCC-8788-4581-A13B-EE69F7E29F22}\WpadNetworkName = "Network 2"	svhost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-35-6e-97-c0-55	svhost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svhost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svhost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\22-35-6e-97-c0-55\WpadDecisionReason = "1"	svhost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exesvhost.exe

description	pid	process
Token: SeDebugPrivilege	1628	88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe
Token: SeDebugPrivilege	944	svhost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

svhost.exe

pid process

944 svhost.exe

pid	process
944	svhost.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

svhost.exe88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe

description	pid	process	target process
PID 944 wrote to memory of 952	944	svhost.exe	IEXPLORE.EXE
PID 944 wrote to memory of 952	944	svhost.exe	IEXPLORE.EXE
PID 944 wrote to memory of 952	944	svhost.exe	IEXPLORE.EXE
PID 944 wrote to memory of 952	944	svhost.exe	IEXPLORE.EXE
PID 1628 wrote to memory of 1048	1628	88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe	cmd.exe
PID 1628 wrote to memory of 1048	1628	88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe	cmd.exe
PID 1628 wrote to memory of 1048	1628	88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe	cmd.exe
PID 1628 wrote to memory of 1048	1628	88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe	cmd.exe
PID 1628 wrote to memory of 1048	1628	88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe	cmd.exe
PID 1628 wrote to memory of 1048	1628	88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe	cmd.exe
PID 1628 wrote to memory of 1048	1628	88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe
"C:\Users\Admin\AppData\Local\Temp\88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  PID:1048

C:\Program Files (x86)\svhost.exe
"C:\Program Files (x86)\svhost.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:944
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\svhost.exe

Filesize
716KB

MD5
ea9ab0d64e6648f9feee920ae60f1c0e

SHA1
2af19e6bebcf278687c4f797bf0ecb9ff84ec2b4

SHA256
88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196

SHA512
9d0399a46df102c8cffd4c60f8a4d78dd7c86d04b454f8b921a971af3085556789592be47e2b4c25be5b5598c702e2b403778017fd8343bd7bbefab8bc9e2ac5

Download Submit
C:\Program Files (x86)\svhost.exe

Filesize
716KB

MD5
ea9ab0d64e6648f9feee920ae60f1c0e

SHA1
2af19e6bebcf278687c4f797bf0ecb9ff84ec2b4

SHA256
88064f99acec119fa6bd7405c52ab427695b49a3876fee6e083a4360553d0196

SHA512
9d0399a46df102c8cffd4c60f8a4d78dd7c86d04b454f8b921a971af3085556789592be47e2b4c25be5b5598c702e2b403778017fd8343bd7bbefab8bc9e2ac5

Download Submit
C:\Windows\uninstal.bat

Filesize
254B

MD5
93fa426826e5ef9d8f9d8aaf8afddc42

SHA1
9c398a67bfa300082dc2d3a13fe25764e7f795f6

SHA256
313ca514754b039e45ff655624af2c960934f8fa22d0d92df400bac89d7e6405

SHA512
d6e448fa96d8283e80b8ba4c0aa895aef42dd504fcf92266a08f094d0785d56e7aaa9b391db143ac6fe57a464c5cbf64b1dc69ccb0a18c444ad6fd43efb247e8

Download Submit
memory/944-59-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/944-63-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1048-61-0x0000000000000000-mapping.dmp

Download
memory/1628-54-0x00000000757B1000-0x00000000757B3000-memory.dmp

Filesize
8KB

Download
memory/1628-55-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download
memory/1628-56-0x0000000000400000-0x00000000004C5000-memory.dmp

Filesize
788KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads