b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8

General

Target

b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe
Size

3.3MB
MD5

ccd03c4afd2128a0a1c71ab49354c596
SHA1

9a6e93ddeec00aabdc7db78f660dd5fa098d7942
SHA256

b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8
SHA512

26d6657e6304037ab5ba33167bdf43fd8ab2464b6d05be705c235095a1f5c61ee2de110c13faadcf6c084df1bc0c8be39ddee635f3f66c312a756d9fbb8e3a06
SSDEEP

49152:FGoEZ3mIDcDnpjQjzxJ1ULCfRxkZ3XbCTEvKRloeRoP7qImLI6qjrkflwk/exXe+:G2aMSX1LRyxuI0ITcU6qjrkfDbfm

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
4644	netsh.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Uses Session Manager for persistence 2 TTPs 3 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows32 = "C:\\windows\\system\\win.exe"	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\reg_0007.txt	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\windows\system\win.exe	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe
File created	C:\windows\system\win.exe	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3396	sc.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3696	schtasks.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe
812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 812	5048	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	82
PID 5048 wrote to memory of 812	5048	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	82
PID 5048 wrote to memory of 812	5048	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	82
PID 812 wrote to memory of 3696	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	83
PID 812 wrote to memory of 3696	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	83
PID 812 wrote to memory of 3696	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	83
PID 812 wrote to memory of 3396	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	84
PID 812 wrote to memory of 3396	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	84
PID 812 wrote to memory of 3396	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	84
PID 812 wrote to memory of 4228	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	85
PID 812 wrote to memory of 4228	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	85
PID 812 wrote to memory of 4228	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	85
PID 812 wrote to memory of 2316	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	86
PID 812 wrote to memory of 2316	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	86
PID 812 wrote to memory of 2316	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	86
PID 812 wrote to memory of 808	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	88
PID 812 wrote to memory of 808	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	88
PID 812 wrote to memory of 808	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	88
PID 812 wrote to memory of 4644	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	93
PID 812 wrote to memory of 4644	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	93
PID 812 wrote to memory of 4644	812	b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe	93

C:\Users\Admin\AppData\Local\Temp\b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe
"C:\Users\Admin\AppData\Local\Temp\b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe
  "C:\Users\Admin\AppData\Local\Temp\b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system
    3⤵
    - Creates scheduled task(s)
    PID:3696
- - C:\Windows\SysWOW64\sc.exe
    sc delete GbpSv
    3⤵
    - Launches sc.exe
    PID:3396
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
    3⤵
    - Uses Session Manager for persistence
    PID:4228
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
    3⤵
    - Uses Session Manager for persistence
    PID:2316
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
    3⤵
    - Uses Session Manager for persistence
    PID:808
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram C:\windows\system\win.exe RPCCC
    3⤵
    - Modifies Windows Firewall
    PID:4644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Modify Existing Service

2

T1031

Registry Run Keys / Startup Folder

Scheduled Task

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~temp0749349918.tmp

Filesize
12B

MD5
37f6a90f88271dcc71e12fae8b5784ea

SHA1
286dac4d4c937605a6104ef90fac18ef4d1f1597

SHA256
de7dfa05adab725939bd1c0dff93ba90e17ed58f1d254bce6070c1c328f24fe7

SHA512
26c7444a35b797c5e0f5678feb8574bbe81bb8a1ea110fcf8ea25f8fc44b965fcc0eb39301f1bd9370209090b3adcd68c244d479909c9375abfc4321af3ffe59

Download Submit
C:\windows\system\win.exe

Filesize
3.3MB

MD5
ccd03c4afd2128a0a1c71ab49354c596

SHA1
9a6e93ddeec00aabdc7db78f660dd5fa098d7942

SHA256
b87a809cf8c01ca65d410356e48699297a0fe4f0acd76f5bd9cfa8cf309f76a8

SHA512
26d6657e6304037ab5ba33167bdf43fd8ab2464b6d05be705c235095a1f5c61ee2de110c13faadcf6c084df1bc0c8be39ddee635f3f66c312a756d9fbb8e3a06

Download Submit
memory/812-148-0x0000000000400000-0x0000000000B10000-memory.dmp

Filesize
7.1MB

Download
memory/812-138-0x0000000000400000-0x0000000000B10000-memory.dmp

Filesize
7.1MB

Download
memory/812-139-0x0000000000B80000-0x0000000000C80000-memory.dmp

Filesize
1024KB

Download
memory/812-146-0x0000000000B80000-0x0000000000C80000-memory.dmp

Filesize
1024KB

Download
memory/5048-133-0x0000000000400000-0x0000000000B10000-memory.dmp

Filesize
7.1MB

Download
memory/5048-137-0x0000000000400000-0x0000000000B10000-memory.dmp

Filesize
7.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads