001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836

General

Target

001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe
Size

670KB
MD5

0ff6745e4ff0a8f84aad2919ba008ded
SHA1

0a06d4c57f48cecaa23752526b53be039bf9fd90
SHA256

001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836
SHA512

ad0c14ff5604ad2a6504402d52c90fb5d17c35e1b894f380a42a5e8c572b8f90a3a168ead535bd606896e3b05084d948be08e6a293308d02e638bd3196abb6ad
SSDEEP

12288:lcJkcAWoVBMRLuDHt9pH4+hwuGclsJEGGAT+CxarfQTHjjuBxn/:oTr+OpuDHhhnGclmEGG2fxrTHHuH/

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

Executes dropped EXE 2 IoCs

pid	Process
1716	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe
1816	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1652-55-0x0000000001290000-0x000000000140E000-memory.dmp	upx
behavioral1/files/0x0007000000012677-57.dat	upx
behavioral1/files/0x0007000000012677-58.dat	upx
behavioral1/memory/1716-61-0x0000000001290000-0x000000000140E000-memory.dmp	upx
behavioral1/files/0x0007000000012677-59.dat	upx
behavioral1/memory/1652-82-0x0000000001290000-0x000000000140E000-memory.dmp	upx

Loads dropped DLL 2 IoCs

pid	Process
1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe
1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/1652-82-0x0000000001290000-0x000000000140E000-memory.dmp	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Windows Server\	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 1816	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1816	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

Suspicious behavior: RenamesItself 2 IoCs

pid	Process
1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe
1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1816	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1716	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	28
PID 1652 wrote to memory of 1716	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	28
PID 1652 wrote to memory of 1716	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	28
PID 1652 wrote to memory of 1716	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	28
PID 1652 wrote to memory of 1816	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	29
PID 1652 wrote to memory of 1816	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	29
PID 1652 wrote to memory of 1816	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	29
PID 1652 wrote to memory of 1816	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	29
PID 1652 wrote to memory of 1816	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	29
PID 1652 wrote to memory of 1816	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	29
PID 1652 wrote to memory of 1816	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	29
PID 1652 wrote to memory of 1816	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	29
PID 1652 wrote to memory of 1816	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	29
PID 1652 wrote to memory of 1816	1652	001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe	29

C:\Users\Admin\AppData\Local\Temp\001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe
"C:\Users\Admin\AppData\Local\Temp\001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe
  C:\Users\Admin\AppData\Local\Temp\001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Users\Admin\AppData\Local\Temp\001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe
  C:\Users\Admin\AppData\Local\Temp\001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

Filesize
670KB

MD5
0ff6745e4ff0a8f84aad2919ba008ded

SHA1
0a06d4c57f48cecaa23752526b53be039bf9fd90

SHA256
001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836

SHA512
ad0c14ff5604ad2a6504402d52c90fb5d17c35e1b894f380a42a5e8c572b8f90a3a168ead535bd606896e3b05084d948be08e6a293308d02e638bd3196abb6ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

Filesize
104KB

MD5
42ccd69a3be9618d329de0ea0fde3a81

SHA1
47e9897f303496eb9cd5883f9cdb283b6eee65d3

SHA256
14137fcc8697e967b251fd0fafbdf79af8db4c1a67f2eafe53756e3ad80a9bef

SHA512
33d95b20ce606441c89dbc575c8e884196a19db056ffd9d54a5e0c57f3928b0d064b6270e4abf033046606e0456156faba3f3a8e6a353e924a7461e61e46bfae

Download Submit
\Users\Admin\AppData\Local\Temp\001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

Filesize
670KB

MD5
0ff6745e4ff0a8f84aad2919ba008ded

SHA1
0a06d4c57f48cecaa23752526b53be039bf9fd90

SHA256
001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836

SHA512
ad0c14ff5604ad2a6504402d52c90fb5d17c35e1b894f380a42a5e8c572b8f90a3a168ead535bd606896e3b05084d948be08e6a293308d02e638bd3196abb6ad

Download Submit
\Users\Admin\AppData\Local\Temp\001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836.exe

Filesize
670KB

MD5
0ff6745e4ff0a8f84aad2919ba008ded

SHA1
0a06d4c57f48cecaa23752526b53be039bf9fd90

SHA256
001800bbcd68d0362c3217addf169227ec29eb7d0f737819a37e75dc6158c836

SHA512
ad0c14ff5604ad2a6504402d52c90fb5d17c35e1b894f380a42a5e8c572b8f90a3a168ead535bd606896e3b05084d948be08e6a293308d02e638bd3196abb6ad

Download Submit
memory/1652-55-0x0000000001290000-0x000000000140E000-memory.dmp

Filesize
1.5MB

Download
memory/1652-56-0x0000000002AE0000-0x0000000002C44000-memory.dmp

Filesize
1.4MB

Download
memory/1652-82-0x0000000001290000-0x000000000140E000-memory.dmp

Filesize
1.5MB

Download
memory/1652-78-0x0000000002AE0000-0x0000000002C44000-memory.dmp

Filesize
1.4MB

Download
memory/1652-80-0x0000000003310000-0x000000000348E000-memory.dmp

Filesize
1.5MB

Download
memory/1652-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1652-79-0x00000000000A0000-0x00000000000A4000-memory.dmp

Filesize
16KB

Download
memory/1716-61-0x0000000001290000-0x000000000140E000-memory.dmp

Filesize
1.5MB

Download
memory/1816-69-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1816-73-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1816-75-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1816-65-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1816-71-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1816-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1816-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1816-81-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download
memory/1816-60-0x0000000000080000-0x000000000017A000-memory.dmp

Filesize
1000KB

Download
memory/1816-83-0x00000000741A0000-0x000000007474B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads