b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39

General

Target

b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe
Size

492KB
MD5

ca075266749ad6303092ba177177aef3
SHA1

8ff64e7c4369fef62e535fbc5f4463f64b4f64d0
SHA256

b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39
SHA512

c01221fe05dec3bc6bc2f877a8dbdd809bac78103497c3bfc9531deede325f634744af24b09a41600b29fd2152233d75de997c0ee8d57f55abedf0bf7ca04dfc
SSDEEP

6144:8DjNqHwgBmU+ofj8FXo8xyAZSWt/WNlsPaZthxORPUerVPokAMa:8/Ne/mU+EwXhOcyZxG8C

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4912	tnjycxCHXEbsjJN.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\s5er4.dat	Process not Found
File created	C:\Windows\system32\config\systemprofile\AppData\Local\s5er4.dat	Process not Found

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.INI	b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe
File created	C:\Windows\tnjycxCHXEbsjJN.exe	b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe
File opened for modification	C:\Windows\tnjycxCHXEbsjJN.INI	tnjycxCHXEbsjJN.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3076	5080	WerFault.exe	82
3808	4912	WerFault.exe	85

Modifies registry class 7 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PCT = "133137710723866583"	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU\PTT = "133137711344804509"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\HAM\AUI\App\V1\LU	Process not Found

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
5080	b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe
5080	b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe
4912	tnjycxCHXEbsjJN.exe
4912	tnjycxCHXEbsjJN.exe
4912	tnjycxCHXEbsjJN.exe
4912	tnjycxCHXEbsjJN.exe
4912	tnjycxCHXEbsjJN.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4912	tnjycxCHXEbsjJN.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5080	b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe
Token: SeDebugPrivilege	4912	tnjycxCHXEbsjJN.exe
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeTcbPrivilege	776	Process not Found
Token: SeDebugPrivilege	776	Process not Found

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5080	b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe
5080	b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe
4912	tnjycxCHXEbsjJN.exe
4912	tnjycxCHXEbsjJN.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4912	5080	b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe	85
PID 5080 wrote to memory of 4912	5080	b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe	85
PID 5080 wrote to memory of 4912	5080	b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe	85
PID 776 wrote to memory of 4864	776	Process not Found	90
PID 776 wrote to memory of 4864	776	Process not Found	90
PID 776 wrote to memory of 4864	776	Process not Found	90
PID 776 wrote to memory of 3452	776	Process not Found	91
PID 776 wrote to memory of 3452	776	Process not Found	91
PID 776 wrote to memory of 3452	776	Process not Found	91
PID 776 wrote to memory of 4264	776	Process not Found	97
PID 776 wrote to memory of 4264	776	Process not Found	97

C:\Users\Admin\AppData\Local\Temp\b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe
"C:\Users\Admin\AppData\Local\Temp\b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 656
  2⤵
  - Program crash
  PID:3076
- C:\Windows\tnjycxCHXEbsjJN.exe
  C:\Users\Admin\AppData\Local\Temp\b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 664
    3⤵
    - Program crash
    PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5080 -ip 5080
1⤵
PID:5040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4912 -ip 4912
1⤵
PID:8

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:4864

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:3452

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:4264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\tnjycxCHXEbsjJN.exe

Filesize
492KB

MD5
ca075266749ad6303092ba177177aef3

SHA1
8ff64e7c4369fef62e535fbc5f4463f64b4f64d0

SHA256
b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39

SHA512
c01221fe05dec3bc6bc2f877a8dbdd809bac78103497c3bfc9531deede325f634744af24b09a41600b29fd2152233d75de997c0ee8d57f55abedf0bf7ca04dfc

Download Submit
C:\Windows\tnjycxCHXEbsjJN.exe

Filesize
492KB

MD5
ca075266749ad6303092ba177177aef3

SHA1
8ff64e7c4369fef62e535fbc5f4463f64b4f64d0

SHA256
b642644ca6ba8509b49e0093119190dd2e39130fd5ee2c96b81bb44457f57f39

SHA512
c01221fe05dec3bc6bc2f877a8dbdd809bac78103497c3bfc9531deede325f634744af24b09a41600b29fd2152233d75de997c0ee8d57f55abedf0bf7ca04dfc

Download Submit
memory/776-148-0x000002C2F8EC0000-0x000002C2F8EF0000-memory.dmp

Filesize
192KB

Download
memory/776-149-0x000002C2F8EF0000-0x000002C2F8F25000-memory.dmp

Filesize
212KB

Download
memory/4912-150-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4912-141-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/4912-145-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5080-140-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5080-133-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/5080-132-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5080-136-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/5080-135-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download

Analysis

Sharing