cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a

General

Target

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Size

200KB
MD5

f8e753c07bea00e2ba2bc8da0b062670
SHA1

ccf6de270318d504c35ffdbca2aa479cac744c2d
SHA256

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a
SHA512

78a41b2628f242e747ac0853572a79fb286c19e41716e29d9d8e89cfaeae0fa88b8426bede33053030ba46f9a14e5819c7eb0159cfa611aae054ccc64184df2e
SSDEEP

3072:5ipy77aAkkCd8rYFBUo5FNZSfYmtw/R/yH2yFfZsYcrmDKVT+BDALV:5iQ7zNo5FNcf4R/dXmDObV

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 18 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

services.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts	services.exe

Modifies security service 2 TTPs 24 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

services.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\DeleteFlag = "1"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	services.exe

Executes dropped EXE 2 IoCs

Processes:

Explorer.EXEservices.exe

pid process

1412 Explorer.EXE
464 services.exe

pid	process
1412	Explorer.EXE
464	services.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$a31e499c3c7c222a40fd7fc6e142514c\\n."	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2292972927-2705560509-2768824231-1000\\$a31e499c3c7c222a40fd7fc6e142514c\\n."	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1712 cmd.exe

pid	process
1712	cmd.exe

Unexpected DNS network traffic destination 9 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Drops desktop.ini file(s) 2 IoCs

Processes:

services.exe

description ioc process

File created \systemroot\assembly\GAC_64\Desktop.ini services.exe
File created \systemroot\assembly\GAC_32\Desktop.ini services.exe

description	ioc	process
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

description	pid	process	target process
PID 1096 set thread context of 1712	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe	cmd.exe

Modifies registry class 6 IoCs

Processes:

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\clsid	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2292972927-2705560509-2768824231-1000\\$a31e499c3c7c222a40fd7fc6e142514c\\n."	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$a31e499c3c7c222a40fd7fc6e142514c\\n."	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exeservices.exe

pid	process
1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
464	services.exe
1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

Processes:

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exeservices.exe

description	pid	process
Token: SeDebugPrivilege	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Token: SeDebugPrivilege	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Token: SeDebugPrivilege	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Token: SeDebugPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1412 Explorer.EXE
1412 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1412 Explorer.EXE
1412 Explorer.EXE

pid	process
1412	Explorer.EXE
1412	Explorer.EXE

pid	process
1412	Explorer.EXE
1412	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

description	pid	process	target process
PID 1096 wrote to memory of 1412	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe	Explorer.EXE
PID 1096 wrote to memory of 1412	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe	Explorer.EXE
PID 1096 wrote to memory of 464	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe	services.exe
PID 1096 wrote to memory of 1712	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe	cmd.exe
PID 1096 wrote to memory of 1712	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe	cmd.exe
PID 1096 wrote to memory of 1712	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe	cmd.exe
PID 1096 wrote to memory of 1712	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe	cmd.exe
PID 1096 wrote to memory of 1712	1096	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe	cmd.exe

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1412

C:\Users\Admin\AppData\Local\Temp\cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
"C:\Users\Admin\AppData\Local\Temp\cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe"
2⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Deletes itself
PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-18\$a31e499c3c7c222a40fd7fc6e142514c\@

Filesize
2KB

MD5
9a949d55a8ed6a2a3f64c8158cdf4ac0

SHA1
416ee3f534fdeea7222d9ab2729ad3ac15a93388

SHA256
fdce0c4b45e4efcd4a36600c71d0c1402e0808069dfd797208167560e52f489d

SHA512
e0f3a4c6ca4e31cec2943025185cf6d63b71d5e5c5637c08d3a985ad0573df467a3e2d1bd4161d5b08e7d9e2f680271fb7819beec66e388fd9dc6d5bd717ed51

Download Submit
C:\$Recycle.Bin\S-1-5-18\$a31e499c3c7c222a40fd7fc6e142514c\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
C:\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\$a31e499c3c7c222a40fd7fc6e142514c\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
\$Recycle.Bin\S-1-5-18\$a31e499c3c7c222a40fd7fc6e142514c\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
\$Recycle.Bin\S-1-5-21-2292972927-2705560509-2768824231-1000\$a31e499c3c7c222a40fd7fc6e142514c\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
memory/1096-55-0x0000000000270000-0x00000000002A9000-memory.dmp

Filesize
228KB

Download
memory/1096-54-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1096-58-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1096-63-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1712-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads