0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42

General

Target

0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe
Size

85KB
MD5

ad2ac8342b8b67c8acb509a5b3e1e7ef
SHA1

26b3f68e3ab6c0e42d0fef09144c3871a55bfa0f
SHA256

0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42
SHA512

223aa6a6a85292d9f63e8e4493ca5f72b72f41f3244453e742d391b48a5213b5279d95cb8400db463dbbabe06a08c94de2e02ed53aeb4df3e1d073b8eee850d5
SSDEEP

1536:ifcshNxsQaEbzEK0jpApeWy3idpmbMjrLOgtuBIq8:YcPjUe3wUwLOgtuBT8

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Program Files (x86)\Common Files\System\servicex.exe = "C:\\Program Files (x86)\\Common Files\\System\\servicex.exe:*:Enabled:Windows Update"	servicex.exe

Executes dropped EXE 1 IoCs

pid	Process
1720	servicex.exe

Loads dropped DLL 2 IoCs

pid	Process
1672	0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe
1672	0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Program Files (x86)\\Common Files\\System\\servicex.exe"	servicex.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\System	0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe
File created	C:\Program Files (x86)\Common Files\System\servicex.exe	0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\servicex.exe	0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe
File opened for modification	C:\Program Files (x86)\Common Files\System	servicex.exe
File created	C:\Program Files (x86)\Common Files\System\servicex.exe	servicex.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\servicex.exe	servicex.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1720	1672	0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe	27
PID 1672 wrote to memory of 1720	1672	0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe	27
PID 1672 wrote to memory of 1720	1672	0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe	27
PID 1672 wrote to memory of 1720	1672	0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe	27

C:\Users\Admin\AppData\Local\Temp\0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe
"C:\Users\Admin\AppData\Local\Temp\0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Common Files\System\servicex.exe
  "C:\Program Files (x86)\Common Files\System\servicex.exe"
  2⤵
  - Modifies firewall policy service
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  PID:1720

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\System\servicex.exe

Filesize
85KB

MD5
ad2ac8342b8b67c8acb509a5b3e1e7ef

SHA1
26b3f68e3ab6c0e42d0fef09144c3871a55bfa0f

SHA256
0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42

SHA512
223aa6a6a85292d9f63e8e4493ca5f72b72f41f3244453e742d391b48a5213b5279d95cb8400db463dbbabe06a08c94de2e02ed53aeb4df3e1d073b8eee850d5

Download Submit
C:\Program Files (x86)\Common Files\System\servicex.exe

Filesize
85KB

MD5
ad2ac8342b8b67c8acb509a5b3e1e7ef

SHA1
26b3f68e3ab6c0e42d0fef09144c3871a55bfa0f

SHA256
0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42

SHA512
223aa6a6a85292d9f63e8e4493ca5f72b72f41f3244453e742d391b48a5213b5279d95cb8400db463dbbabe06a08c94de2e02ed53aeb4df3e1d073b8eee850d5

Download Submit
\Program Files (x86)\Common Files\System\servicex.exe

Filesize
85KB

MD5
ad2ac8342b8b67c8acb509a5b3e1e7ef

SHA1
26b3f68e3ab6c0e42d0fef09144c3871a55bfa0f

SHA256
0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42

SHA512
223aa6a6a85292d9f63e8e4493ca5f72b72f41f3244453e742d391b48a5213b5279d95cb8400db463dbbabe06a08c94de2e02ed53aeb4df3e1d073b8eee850d5

Download Submit
\Program Files (x86)\Common Files\System\servicex.exe

Filesize
85KB

MD5
ad2ac8342b8b67c8acb509a5b3e1e7ef

SHA1
26b3f68e3ab6c0e42d0fef09144c3871a55bfa0f

SHA256
0769c60824b07e659b94285536a7a046dc95371d184c8ee3d5cb5b1c88f51d42

SHA512
223aa6a6a85292d9f63e8e4493ca5f72b72f41f3244453e742d391b48a5213b5279d95cb8400db463dbbabe06a08c94de2e02ed53aeb4df3e1d073b8eee850d5

Download Submit
memory/1672-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads