8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625

General

Target

8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Size

80KB
MD5

b803acee7e3e6b92e1c185a71a81790f
SHA1

5ced433c728d0667f3a98689649ed722942f1cc4
SHA256

8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625
SHA512

e555469b6da31c7c0b0bf611e5110dabc04ed3568137d17c716802f80bdc9b87a1a44c4e86b8d9e50edddc4e36d2c5c16eda8ff76afd18362e118d84ead3f77d
SSDEEP

1536:PwEJOVKRytAB0YBIxZcafY6X4RqGGDkTZB7zA6fyMoyt:5stADOcan4UVkjfyMoyt

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\SessMgr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sessmgr.exe /waitservice"	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\CmSTP = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\cmstp.exe /waitservice"	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe

Executes dropped EXE 1 IoCs

pid	Process
2736	esentutl.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Key created	\REGISTRY\USER\.DEFAULT	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MstInit = "C:\\Users\\Admin\\LOCALS~1\\APPLIC~1\\MICROS~1\\mstinit.exe /waitservice"	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 2736	3100	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe	78
PID 3100 wrote to memory of 2736	3100	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe	78
PID 3100 wrote to memory of 2736	3100	8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe	78

C:\Users\Admin\AppData\Local\Temp\8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe
"C:\Users\Admin\AppData\Local\Temp\8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625.exe"
1⤵
- Adds policy Run key to start application
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Users\Admin\LOCALS~1\APPLIC~1\esentutl.exe
  C:\Users\Admin\LOCALS~1\APPLIC~1\esentutl.exe /waitservice
  2⤵
  - Executes dropped EXE
  PID:2736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sessmgr.exe

Filesize
80KB

MD5
b803acee7e3e6b92e1c185a71a81790f

SHA1
5ced433c728d0667f3a98689649ed722942f1cc4

SHA256
8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625

SHA512
e555469b6da31c7c0b0bf611e5110dabc04ed3568137d17c716802f80bdc9b87a1a44c4e86b8d9e50edddc4e36d2c5c16eda8ff76afd18362e118d84ead3f77d

Download Submit
C:\Users\Admin\AppData\Local\esentutl.exe

Filesize
80KB

MD5
b803acee7e3e6b92e1c185a71a81790f

SHA1
5ced433c728d0667f3a98689649ed722942f1cc4

SHA256
8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625

SHA512
e555469b6da31c7c0b0bf611e5110dabc04ed3568137d17c716802f80bdc9b87a1a44c4e86b8d9e50edddc4e36d2c5c16eda8ff76afd18362e118d84ead3f77d

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\cmstp.exe

Filesize
80KB

MD5
b803acee7e3e6b92e1c185a71a81790f

SHA1
5ced433c728d0667f3a98689649ed722942f1cc4

SHA256
8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625

SHA512
e555469b6da31c7c0b0bf611e5110dabc04ed3568137d17c716802f80bdc9b87a1a44c4e86b8d9e50edddc4e36d2c5c16eda8ff76afd18362e118d84ead3f77d

Download Submit
C:\Users\Admin\LOCALS~1\APPLIC~1\MICROS~1\mstinit.exe

Filesize
80KB

MD5
b803acee7e3e6b92e1c185a71a81790f

SHA1
5ced433c728d0667f3a98689649ed722942f1cc4

SHA256
8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625

SHA512
e555469b6da31c7c0b0bf611e5110dabc04ed3568137d17c716802f80bdc9b87a1a44c4e86b8d9e50edddc4e36d2c5c16eda8ff76afd18362e118d84ead3f77d

Download Submit
C:\Users\Admin\LOCALS~1\APPLIC~1\esentutl.exe

Filesize
80KB

MD5
b803acee7e3e6b92e1c185a71a81790f

SHA1
5ced433c728d0667f3a98689649ed722942f1cc4

SHA256
8f82f055e69813f62374b4d99a75a720ac13721a0359f452bf679292412c2625

SHA512
e555469b6da31c7c0b0bf611e5110dabc04ed3568137d17c716802f80bdc9b87a1a44c4e86b8d9e50edddc4e36d2c5c16eda8ff76afd18362e118d84ead3f77d

Download Submit
memory/2736-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing