c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475

General

Target

c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe
Size

538KB
MD5

8bf1a7c0b986753dc55ac591fd87502e
SHA1

74cf75aedaf4d8318639a554cb0f49b3e90eb585
SHA256

c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475
SHA512

8aab9a9cf7cdb7981e8d9be1ee10b079f4e1637d91adef41f6a28a357ba268ce1f751fd0e1ca3b3c87e61a8ca9f5d660321513e90b0d520b70fec2d6b0e15ff9
SSDEEP

6144:+nk0yCBGRVvMBRDojcGncLgeVT92ZcsAxSHsaiHDbAB3i:sBy4GROoAL5VT9ycs1OG3

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

Processes:

c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe

pid process

1956 c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe

pid	process
1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exeExplorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\SunkuMgogh = "regsvr32.exe \"C:\\ProgramData\\SunkuMgogh\\SunkuMgogh.dat\""	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\SunkuMgogh = "regsvr32.exe \"C:\\ProgramData\\SunkuMgogh\\SunkuMgogh.dat\""	Explorer.EXE

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	Explorer.EXE

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\TabProcGrowth = "0"	Explorer.EXE

Modifies registry class 6 IoCs

Processes:

Explorer.EXEc743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{5E005442-4268-439F-A1AF-5457400E3343}	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{5E005442-4268-439F-A1AF-5457400E3343}\{72447854-3618-4163-B468-349C206D2F1D} = 66702bf2	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{7C080192-5BC1-4D3D-B762-011B7FA77445}\#cert = 31	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{7C080192-5BC1-4D3D-B762-011B7FA77445}	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{7C080192-5BC1-4D3D-B762-011B7FA77445}\#sd = 433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c54656d705c633734333534316433663362343764613762393531303439303462613336343266646465343732383733666464666435396136376365346665303063393437352e65786500	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{7C080192-5BC1-4D3D-B762-011B7FA77445}	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe

pid process

1956 c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe

pid	process
1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exeExplorer.EXE

description	pid	process
Token: SeCreateGlobalPrivilege	1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe
Token: SeDebugPrivilege	1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe
Token: SeCreateGlobalPrivilege	1296	Explorer.EXE
Token: SeShutdownPrivilege	1296	Explorer.EXE
Token: SeDebugPrivilege	1296	Explorer.EXE

Suspicious use of UnmapMainImage 1 IoCs

Processes:

c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe

pid process

1956 c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe

pid	process
1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe

description	pid	process	target process
PID 1956 wrote to memory of 336	1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe	spoolsv.exe
PID 1956 wrote to memory of 336	1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe	spoolsv.exe
PID 1956 wrote to memory of 1296	1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe	Explorer.EXE
PID 1956 wrote to memory of 1296	1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe	Explorer.EXE
PID 1956 wrote to memory of 1092	1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe	sppsvc.exe
PID 1956 wrote to memory of 1092	1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe	sppsvc.exe
PID 1956 wrote to memory of 1996	1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe	WMIADAP.EXE
PID 1956 wrote to memory of 1996	1956	c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe	WMIADAP.EXE

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1996

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:1092

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Adds Run key to start application
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Users\Admin\AppData\Local\Temp\c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe
"C:\Users\Admin\AppData\Local\Temp\c743541d3f3b47da7b95104904ba3642fdde472873fddfd59a67ce4fe00c9475.exe"
2⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1956

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:336

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SunkuMgogh\SunkuMgogh.dat
Filesize
264KB

MD5
687985564e3083815d0f80e652f8d045

SHA1
9e292e5ff1b6454ae048b2e0690412fb1d216ab6

SHA256
dda3060ddafaa8c1778d3b92a92c7fc6e39b373590b0693885a6d16709d13beb

SHA512
cdb3a9083097b4989fdce468e2ba672b1727d9e36a2db1005e6c712331918600cfa17e44d514bf16d98493cfd82714187575f09aab1b5f185d6654f0460c3153

Download Submit
\ProgramData\SunkuMgogh\SunkuMgogh.dat
Filesize
264KB

MD5
687985564e3083815d0f80e652f8d045

SHA1
9e292e5ff1b6454ae048b2e0690412fb1d216ab6

SHA256
dda3060ddafaa8c1778d3b92a92c7fc6e39b373590b0693885a6d16709d13beb

SHA512
cdb3a9083097b4989fdce468e2ba672b1727d9e36a2db1005e6c712331918600cfa17e44d514bf16d98493cfd82714187575f09aab1b5f185d6654f0460c3153

Download Submit
memory/336-60-0x0000000001C00000-0x0000000001C54000-memory.dmp

Filesize
336KB

Download
memory/1296-73-0x00000000029D0000-0x0000000002A24000-memory.dmp

Filesize
336KB

Download
memory/1296-74-0x0000000002B70000-0x0000000002BDB000-memory.dmp

Filesize
428KB

Download
memory/1956-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/1956-55-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1956-58-0x0000000074840000-0x0000000074873000-memory.dmp

Filesize
204KB

Download
memory/1956-71-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1956-72-0x0000000074840000-0x00000000748AB000-memory.dmp

Filesize
428KB

Download
memory/1956-76-0x0000000074840000-0x0000000074873000-memory.dmp

Filesize
204KB

Download
memory/1956-75-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads