7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5

General

Target

7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe
Size

762KB
MD5

bb965ce1be25c790ff7046fed15a70bd
SHA1

6939c667e763c5060a43e824bafd421bd04f23e0
SHA256

7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5
SHA512

bfaf6df157b0992a6324e05796596aa57600d1996d71b7da39bd2e3a4aaa6f551552a0f8cda8ddc1f3f22a2dc032e4a089220788efd8e6da77692d094b7345cd
SSDEEP

12288:YcGCDxBVWh9ABS+7s0gpnp50BYDdkmgphI/5K+qgzI1TNTjhrP3C9E3ix:aYx3WysN75uEkm8mKAIP5tix

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\M-5039582462748354025\winmgr.exe = "C:\\Users\\Admin\\M-5039582462748354025\\winmgr.exe:*:Enabled:Microsoft Windows Manager"	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe

Executes dropped EXE 2 IoCs

pid	Process
284	winmgr.exe
684	winmgr.exe

Loads dropped DLL 2 IoCs

pid	Process
1448	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe
1448	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Users\\Admin\\M-5039582462748354025\\winmgr.exe"	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1480 set thread context of 1448	1480	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe	28
PID 284 set thread context of 684	284	winmgr.exe	30

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
1480	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe
1480	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe
284	winmgr.exe
284	winmgr.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 1448	1480	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe	28
PID 1480 wrote to memory of 1448	1480	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe	28
PID 1480 wrote to memory of 1448	1480	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe	28
PID 1480 wrote to memory of 1448	1480	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe	28
PID 1448 wrote to memory of 284	1448	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe	29
PID 1448 wrote to memory of 284	1448	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe	29
PID 1448 wrote to memory of 284	1448	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe	29
PID 1448 wrote to memory of 284	1448	7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe	29
PID 284 wrote to memory of 684	284	winmgr.exe	30
PID 284 wrote to memory of 684	284	winmgr.exe	30
PID 284 wrote to memory of 684	284	winmgr.exe	30
PID 284 wrote to memory of 684	284	winmgr.exe	30

C:\Users\Admin\AppData\Local\Temp\7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe
"C:\Users\Admin\AppData\Local\Temp\7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Users\Admin\AppData\Local\Temp\7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe
  "C:\Users\Admin\AppData\Local\Temp\7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5.exe"
  2⤵
  - Modifies firewall policy service
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1448
- - C:\Users\Admin\M-5039582462748354025\winmgr.exe
    C:\Users\Admin\M-5039582462748354025\winmgr.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:284
  - - C:\Users\Admin\M-5039582462748354025\winmgr.exe
      C:\Users\Admin\M-5039582462748354025\winmgr.exe
      4⤵
      Executes dropped EXE
      PID:684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\M-5039582462748354025\winmgr.exe

Filesize
762KB

MD5
bb965ce1be25c790ff7046fed15a70bd

SHA1
6939c667e763c5060a43e824bafd421bd04f23e0

SHA256
7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5

SHA512
bfaf6df157b0992a6324e05796596aa57600d1996d71b7da39bd2e3a4aaa6f551552a0f8cda8ddc1f3f22a2dc032e4a089220788efd8e6da77692d094b7345cd

Download Submit
C:\Users\Admin\M-5039582462748354025\winmgr.exe

Filesize
762KB

MD5
bb965ce1be25c790ff7046fed15a70bd

SHA1
6939c667e763c5060a43e824bafd421bd04f23e0

SHA256
7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5

SHA512
bfaf6df157b0992a6324e05796596aa57600d1996d71b7da39bd2e3a4aaa6f551552a0f8cda8ddc1f3f22a2dc032e4a089220788efd8e6da77692d094b7345cd

Download Submit
C:\Users\Admin\M-5039582462748354025\winmgr.exe

Filesize
762KB

MD5
bb965ce1be25c790ff7046fed15a70bd

SHA1
6939c667e763c5060a43e824bafd421bd04f23e0

SHA256
7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5

SHA512
bfaf6df157b0992a6324e05796596aa57600d1996d71b7da39bd2e3a4aaa6f551552a0f8cda8ddc1f3f22a2dc032e4a089220788efd8e6da77692d094b7345cd

Download Submit
\Users\Admin\M-5039582462748354025\winmgr.exe

Filesize
762KB

MD5
bb965ce1be25c790ff7046fed15a70bd

SHA1
6939c667e763c5060a43e824bafd421bd04f23e0

SHA256
7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5

SHA512
bfaf6df157b0992a6324e05796596aa57600d1996d71b7da39bd2e3a4aaa6f551552a0f8cda8ddc1f3f22a2dc032e4a089220788efd8e6da77692d094b7345cd

Download Submit
\Users\Admin\M-5039582462748354025\winmgr.exe

Filesize
762KB

MD5
bb965ce1be25c790ff7046fed15a70bd

SHA1
6939c667e763c5060a43e824bafd421bd04f23e0

SHA256
7d87fb78d89c4ec8d1249db7d90c941a026f7f5dd4e7e6523223f557259d0ea5

SHA512
bfaf6df157b0992a6324e05796596aa57600d1996d71b7da39bd2e3a4aaa6f551552a0f8cda8ddc1f3f22a2dc032e4a089220788efd8e6da77692d094b7345cd

Download Submit
memory/284-60-0x0000000000000000-mapping.dmp

Download
memory/684-64-0x00000000004038B0-mapping.dmp

Download
memory/1448-55-0x00000000004038B0-mapping.dmp

Download
memory/1448-57-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/1480-54-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads