cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a

General

Target

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Size

200KB
MD5

f8e753c07bea00e2ba2bc8da0b062670
SHA1

ccf6de270318d504c35ffdbca2aa479cac744c2d
SHA256

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a
SHA512

78a41b2628f242e747ac0853572a79fb286c19e41716e29d9d8e89cfaeae0fa88b8426bede33053030ba46f9a14e5819c7eb0159cfa611aae054ccc64184df2e
SSDEEP

3072:5ipy77aAkkCd8rYFBUo5FNZSfYmtw/R/yH2yFfZsYcrmDKVT+BDALV:5iQ7zNo5FNcf4R/dXmDObV

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Explorer.EXE

pid process

2492 Explorer.EXE

pid	process
2492	Explorer.EXE

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2295526160-1155304984-640977766-1000\\$e0613d909b67ae6058f9584af5f18b89\\n."	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Modifies registry class 5 IoCs

Processes:

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2295526160-1155304984-640977766-1000\\$e0613d909b67ae6058f9584af5f18b89\\n."	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\clsid	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exeExplorer.EXE

pid	process
876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
2492	Explorer.EXE
2492	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2492 Explorer.EXE

pid	process
2492	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Token: SeDebugPrivilege	876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Token: SeDebugPrivilege	876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
Token: SeDebugPrivilege	2492	Explorer.EXE

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe

description	pid	process	target process
PID 876 wrote to memory of 2492	876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe	Explorer.EXE
PID 876 wrote to memory of 2492	876	cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Users\Admin\AppData\Local\Temp\cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe
"C:\Users\Admin\AppData\Local\Temp\cc1486e1cfad889f62072f31c5e63c7ed6f9fc861787d61618ecceca16bae29a.exe"
2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\$e0613d909b67ae6058f9584af5f18b89\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\$e0613d909b67ae6058f9584af5f18b89\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
memory/876-132-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/876-133-0x0000000002180000-0x00000000021B9000-memory.dmp

Filesize
228KB

Download
memory/876-134-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/876-137-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/876-138-0x0000000002180000-0x00000000021B9000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads