a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842

General

Target

a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
Size

160KB
MD5

7fa2a2a3bd5117f720703a73de356641
SHA1

15526e163edc114fa0fdb3eb25cbdc2f570cd030
SHA256

a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842
SHA512

0f86654dc889fea11aaaf37a3127a5a20cfc2355244ec6ebfffb65016c2d277d7de3b0b9cba9057aead1788c4d7742a7e58eaba8e0c40107f56d9420fa6b9ffc
SSDEEP

3072:D8noOtY5BmmYdb2guUoYIt5XzlQ99Z8bKnNTIOWYhWuQ+eQtV3Y:lbG0guYIt5XK9/gGNMFFQ

Score

8^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\\n."	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

768 cmd.exe

pid	process
768	cmd.exe

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Drops desktop.ini file(s) 2 IoCs

Processes:

services.exe

description ioc process

File created \systemroot\assembly\GAC_64\Desktop.ini services.exe
File created \systemroot\assembly\GAC_32\Desktop.ini services.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe

description pid process target process

PID 1976 set thread context of 768 1976 a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe cmd.exe

description	ioc	process
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe

description	pid	process	target process
PID 1976 set thread context of 768	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe	cmd.exe

Drops file in Windows directory 2 IoCs

Processes:

a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe

description	ioc	process
File created	C:\Windows\Installer\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\@	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
File created	C:\Windows\Installer\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\n	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe

Modifies registry class 5 IoCs

Processes:

a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\\n."	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\clsid	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exeservices.exe

pid	process
1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
464	services.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exeservices.exe

description	pid	process
Token: SeDebugPrivilege	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
Token: SeDebugPrivilege	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
Token: SeDebugPrivilege	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
Token: SeDebugPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1400 Explorer.EXE
1400 Explorer.EXE

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

pid	process
1400	Explorer.EXE
1400	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe

description	pid	process	target process
PID 1976 wrote to memory of 1400	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe	Explorer.EXE
PID 1976 wrote to memory of 1400	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe	Explorer.EXE
PID 1976 wrote to memory of 464	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe	services.exe
PID 1976 wrote to memory of 768	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe	cmd.exe
PID 1976 wrote to memory of 768	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe	cmd.exe
PID 1976 wrote to memory of 768	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe	cmd.exe
PID 1976 wrote to memory of 768	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe	cmd.exe
PID 1976 wrote to memory of 768	1976	a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe	cmd.exe

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1400

C:\Users\Admin\AppData\Local\Temp\a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe
"C:\Users\Admin\AppData\Local\Temp\a95d8cc49718e80778b6e991536bf06970646e4f96c000a54442376824402842.exe"
2⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Deletes itself
PID:768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\systemroot\Installer\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\@
Filesize
2KB

MD5
88f318a6d8c16d14eeb264ed328cdccc

SHA1
38622061e2fd1832e2d1ead13432ecd95a66681d

SHA256
d5cb42b5a5aa09b1ee8e311b642f9dc91c3c9683a79f48d3fa2c729e92adbf24

SHA512
d0f8ad41ff56ecff124282b94aa2b44908c0299219d8f5ae26cb209ff641c8457722af918fba6f85d9d74574eb7a2f69a87f8f3d5dcfbb624899655d4e112225

Download Submit
memory/464-79-0x00000000000A0000-0x00000000000AF000-memory.dmp

Filesize
60KB

Download
memory/464-72-0x0000000000090000-0x000000000009F000-memory.dmp

Filesize
60KB

Download
memory/464-76-0x0000000000090000-0x000000000009F000-memory.dmp

Filesize
60KB

Download
memory/464-78-0x0000000000080000-0x000000000008C000-memory.dmp

Filesize
48KB

Download
memory/464-83-0x00000000000A0000-0x00000000000AF000-memory.dmp

Filesize
60KB

Download
memory/464-82-0x0000000000080000-0x000000000008C000-memory.dmp

Filesize
48KB

Download
memory/768-84-0x0000000000000000-mapping.dmp

Download
memory/1400-57-0x0000000002230000-0x000000000223F000-memory.dmp

Filesize
60KB

Download
memory/1400-61-0x0000000002230000-0x000000000223F000-memory.dmp

Filesize
60KB

Download
memory/1400-81-0x0000000002210000-0x000000000221C000-memory.dmp

Filesize
48KB

Download
memory/1400-67-0x0000000002610000-0x000000000261F000-memory.dmp

Filesize
60KB

Download
memory/1400-66-0x0000000002210000-0x000000000221C000-memory.dmp

Filesize
48KB

Download
memory/1400-65-0x0000000002230000-0x000000000223F000-memory.dmp

Filesize
60KB

Download
memory/1976-85-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1976-56-0x0000000000220000-0x0000000000258000-memory.dmp

Filesize
224KB

Download
memory/1976-54-0x0000000000220000-0x0000000000258000-memory.dmp

Filesize
224KB

Download
memory/1976-80-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1976-55-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads