547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848

General

Target

547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe
Size

460KB
MD5

42ea65ffc61947188cdb79cd9c0daf69
SHA1

6de811d563fb014b847319e525f0abb2b33e1691
SHA256

547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848
SHA512

f92e902eff76b4b2f46d278f8b0a1eb41d9beec6fcb010b8a1bf2c1269de9e0fcb8ae9d027a18e457eeca47079469022b842207934a952bde0fadfa83408e1c1
SSDEEP

12288:+sAw9HD4XRhlitra71HPVzRZvZlk7Mb3c/M7aYz3SaQOEXsasmgQBoVR/uZ:DuvlitqptRbB

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1040	MNnvyTciUUCUUeH.exe

Deletes itself 1 IoCs

pid	Process
1040	MNnvyTciUUCUUeH.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
22	icanhazip.com

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\f5e83w4ef.dat	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\f5e83w4ef.dat	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Process not Found
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0SMVW5K9.txt	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\MNnvyTciUUCUUeH.exe	547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96}	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96}\WpadDecisionReason = "1"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Process not Found
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0046000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96}\WpadDecisionTime = f08d3f028a03d901	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Process not Found
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-6a-f5-61-2a-69	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-6a-f5-61-2a-69\WpadDecisionReason = "1"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-6a-f5-61-2a-69\WpadDecision = "0"	Process not Found
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96}\WpadNetworkName = "Network 2"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96}\5e-6a-f5-61-2a-69	Process not Found
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-6a-f5-61-2a-69\WpadDecisionTime = f08d3f028a03d901	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2F4EA2D8-ECA7-46E7-A7E7-6CCB38930A96}\WpadDecision = "0"	Process not Found

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1828	547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe
1040	MNnvyTciUUCUUeH.exe
1040	MNnvyTciUUCUUeH.exe
1040	MNnvyTciUUCUUeH.exe
584	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1040	MNnvyTciUUCUUeH.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1828	547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe
Token: SeDebugPrivilege	1040	MNnvyTciUUCUUeH.exe
Token: SeDebugPrivilege	584	Process not Found

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1828	547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe
1040	MNnvyTciUUCUUeH.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1040	1828	547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe	28
PID 1828 wrote to memory of 1040	1828	547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe	28
PID 1828 wrote to memory of 1040	1828	547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe	28
PID 1828 wrote to memory of 1040	1828	547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe	28

C:\Users\Admin\AppData\Local\Temp\547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe
"C:\Users\Admin\AppData\Local\Temp\547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\MNnvyTciUUCUUeH.exe
  C:\Users\Admin\AppData\Local\Temp\547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848.exe
  2⤵
  - Executes dropped EXE
  - Deletes itself
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  PID:1040

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\MNnvyTciUUCUUeH.exe

Filesize
460KB

MD5
42ea65ffc61947188cdb79cd9c0daf69

SHA1
6de811d563fb014b847319e525f0abb2b33e1691

SHA256
547fe86a840917a2fde70774e1fa8a2610581b42206474303231ded2f4179848

SHA512
f92e902eff76b4b2f46d278f8b0a1eb41d9beec6fcb010b8a1bf2c1269de9e0fcb8ae9d027a18e457eeca47079469022b842207934a952bde0fadfa83408e1c1

Download Submit
memory/584-66-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/584-67-0x0000000000440000-0x000000000047A000-memory.dmp

Filesize
232KB

Download
memory/584-69-0x000007FEFBAF1000-0x000007FEFBAF3000-memory.dmp

Filesize
8KB

Download
memory/1040-65-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/1040-68-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1828-54-0x0000000075611000-0x0000000075613000-memory.dmp

Filesize
8KB

Download
memory/1828-55-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1828-56-0x0000000000401000-0x0000000000404000-memory.dmp

Filesize
12KB

Download
memory/1828-60-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing