0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

General

Target

0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Size

981KB
MD5

6c7bb74133fa4462f030de13415108d1
SHA1

61f2bc88935451f0525ccd9e2dba7ff00a3f641b
SHA256

0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b
SHA512

534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1
SSDEEP

12288:rVTvRaeKGlHiM4lKD13YxWnVZunCAEJYQHxw88o8786sfRJ/kkkkckkkkbkkkhkh:tvbvlZVRhnbVAEa1YfJi

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\M-50507564324649683503740\winsvc.exe = "C:\\Windows\\M-50507564324649683503740\\winsvc.exe:*:Enabled:Microsoft Windows Service"	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe

Executes dropped EXE 2 IoCs

pid	Process
4688	winsvc.exe
2000	winsvc.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows\CurrentVersion\Run\	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\M-50507564324649683503740\\winsvc.exe"	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Windows\\M-50507564324649683503740\\winsvc.exe"	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4876 set thread context of 3588	4876	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	85
PID 4688 set thread context of 2000	4688	winsvc.exe	89

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\M-50507564324649683503740\winsvc.exe	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
File opened for modification	C:\Windows\M-50507564324649683503740	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
File created	C:\Windows\M-50507564324649683503740\winsvc.exe	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
4876	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
4876	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
4688	winsvc.exe
4688	winsvc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 3588	4876	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	85
PID 4876 wrote to memory of 3588	4876	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	85
PID 4876 wrote to memory of 3588	4876	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	85
PID 3588 wrote to memory of 4688	3588	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	86
PID 3588 wrote to memory of 4688	3588	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	86
PID 3588 wrote to memory of 4688	3588	0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe	86
PID 4688 wrote to memory of 2000	4688	winsvc.exe	89
PID 4688 wrote to memory of 2000	4688	winsvc.exe	89
PID 4688 wrote to memory of 2000	4688	winsvc.exe	89

C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
"C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
  "C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe"
  2⤵
  - Modifies firewall policy service
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:3588
- - C:\Windows\M-50507564324649683503740\winsvc.exe
    C:\Windows\M-50507564324649683503740\winsvc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\M-50507564324649683503740\winsvc.exe
      C:\Windows\M-50507564324649683503740\winsvc.exe
      4⤵
      Executes dropped EXE
      PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\M-50507564324649683503740\winsvc.exe

Filesize
981KB

MD5
6c7bb74133fa4462f030de13415108d1

SHA1
61f2bc88935451f0525ccd9e2dba7ff00a3f641b

SHA256
0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

SHA512
534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

Download Submit
C:\Windows\M-50507564324649683503740\winsvc.exe

Filesize
981KB

MD5
6c7bb74133fa4462f030de13415108d1

SHA1
61f2bc88935451f0525ccd9e2dba7ff00a3f641b

SHA256
0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

SHA512
534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

Download Submit
C:\Windows\M-50507564324649683503740\winsvc.exe

Filesize
981KB

MD5
6c7bb74133fa4462f030de13415108d1

SHA1
61f2bc88935451f0525ccd9e2dba7ff00a3f641b

SHA256
0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

SHA512
534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

Download Submit
memory/2000-140-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3588-134-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4876-133-0x0000000002260000-0x0000000002268000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads