83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614

General

Target

83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
Size

168KB
MD5

ecc8daa9c96bd99c1419ebeea32b1b67
SHA1

c3f4924a4f5e03f9016381869e9d1b7e35a5d5ec
SHA256

83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614
SHA512

cfd64fc43dba20252db55e2f11c107aed10ff3ace8500f7dd679f1ca75d149f39cbd5669fb2dfdb2c7cb9326e000a90800866724057a924174b4c888fadfd60f
SSDEEP

3072:7Lg95BKAUeKMKk4oIOA2CY1Qrz4+JSVwGj9vjjZ4FKtkN6EWwKXWH+/snyJs/xuz:7Lg95tUbk7IOFyrcHVwGJLl4FJN5SmHt

Score

8^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\\n."	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe

Deletes itself 1 IoCs

pid	Process
300	cmd.exe

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1104 set thread context of 300	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe	27

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\@	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
File created	C:\Windows\Installer\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\n	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\clsid	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\\n."	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
464	services.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1360	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
Token: SeDebugPrivilege	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
Token: SeDebugPrivilege	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
Token: SeDebugPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1360	Explorer.EXE
1360	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1360	Explorer.EXE
1360	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 1360	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe	15
PID 1104 wrote to memory of 1360	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe	15
PID 1104 wrote to memory of 464	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe	2
PID 1104 wrote to memory of 300	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe	27
PID 1104 wrote to memory of 300	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe	27
PID 1104 wrote to memory of 300	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe	27
PID 1104 wrote to memory of 300	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe	27
PID 1104 wrote to memory of 300	1104	83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe	27

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1360
- C:\Users\Admin\AppData\Local\Temp\83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe
  "C:\Users\Admin\AppData\Local\Temp\83baf992a37a10a99b6f5cfc9b9ae2600fff57248fb584590f8c04fc9c52c614.exe"
  2⤵
  - Registers COM server for autorun
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:300

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\systemroot\Installer\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\@

Filesize
2KB

MD5
cf0d89f6fb9fb3957edc9e09b9d69878

SHA1
c21c1cf908955dbe2e7ecb8beb129c738a673933

SHA256
bd9d0babbf61ba8bfee04287e06374777d5d6d0708e85f776f821240defba6ff

SHA512
b616a81475f0b5d3a1e2b29a7255b0dd6d7f073f9a91cde3e0ee7f88514e760f0d529370a37ebbb96c40894e869d6bb52d3e32f30473b2e67233ce04c049e710

Download Submit
memory/464-82-0x0000000000130000-0x000000000013F000-memory.dmp

Filesize
60KB

Download
memory/464-81-0x00000000000F0000-0x00000000000FC000-memory.dmp

Filesize
48KB

Download
memory/464-75-0x0000000000120000-0x000000000012F000-memory.dmp

Filesize
60KB

Download
memory/464-71-0x0000000000120000-0x000000000012F000-memory.dmp

Filesize
60KB

Download
memory/464-77-0x00000000000F0000-0x00000000000FC000-memory.dmp

Filesize
48KB

Download
memory/464-78-0x0000000000130000-0x000000000013F000-memory.dmp

Filesize
60KB

Download
memory/1104-79-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1104-84-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1104-64-0x0000000000440000-0x0000000000476000-memory.dmp

Filesize
216KB

Download
memory/1104-63-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1360-65-0x00000000021F0000-0x00000000021FC000-memory.dmp

Filesize
48KB

Download
memory/1360-80-0x00000000021F0000-0x00000000021FC000-memory.dmp

Filesize
48KB

Download
memory/1360-66-0x0000000002A80000-0x0000000002A8F000-memory.dmp

Filesize
60KB

Download
memory/1360-62-0x0000000002A70000-0x0000000002A7F000-memory.dmp

Filesize
60KB

Download
memory/1360-54-0x0000000002A70000-0x0000000002A7F000-memory.dmp

Filesize
60KB

Download
memory/1360-58-0x0000000002A70000-0x0000000002A7F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing