5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1

General

Target

5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
Size

196KB
MD5

130caa46dcff97da4613fc64f31e9a30
SHA1

874370850b192edffe2111818cb1f6f6584cf17b
SHA256

5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1
SHA512

ba3ad390890669bd7c67622016af39f4186b33bd40d6df220fc98e4e17b2e52e0437a869662ca47dff1ede3f6005d0df9e1b4de84815773c6e1f127736c777d8
SSDEEP

3072:tXWOYmnDOqTXNg0DtViDZ92tnkGf+M0AviA9fpLljgAXBu/cYGPqM5:MADnhHpwyJhZpJVXBuKyM

Score

8^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{bb8ab67a-d838-2496-fd4e-ead6952e3208}\\n."	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe

Deletes itself 1 IoCs

pid	Process
1524	cmd.exe

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 1524	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe	27

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{bb8ab67a-d838-2496-fd4e-ead6952e3208}\@	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
File created	C:\Windows\Installer\{bb8ab67a-d838-2496-fd4e-ead6952e3208}\n	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\clsid	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{bb8ab67a-d838-2496-fd4e-ead6952e3208}\\n."	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
464	services.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
Token: SeDebugPrivilege	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
Token: SeDebugPrivilege	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
Token: SeDebugPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 1212	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe	14
PID 1688 wrote to memory of 1212	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe	14
PID 1688 wrote to memory of 464	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe	2
PID 1688 wrote to memory of 1524	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe	27
PID 1688 wrote to memory of 1524	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe	27
PID 1688 wrote to memory of 1524	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe	27
PID 1688 wrote to memory of 1524	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe	27
PID 1688 wrote to memory of 1524	1688	5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe	27

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1212
- C:\Users\Admin\AppData\Local\Temp\5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe
  "C:\Users\Admin\AppData\Local\Temp\5b629e172ab677105dbd5a6b4fd1571cea846ae2f979a1d40530d8b6a4b244e1.exe"
  2⤵
  - Registers COM server for autorun
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\systemroot\Installer\{bb8ab67a-d838-2496-fd4e-ead6952e3208}\@

Filesize
2KB

MD5
87bc53fdbb92004d82532aad2891d8a2

SHA1
b9c85c67525d44f60caeb66bf78986837336c07c

SHA256
57ef5635eb8dfaad439e5458020cb76ec5e7cb491c2b6b0294e1c26befcde097

SHA512
4be9ec996d22ff600c2ec929c201d2a273b43dbef6baa7a2966e253e97f68271229e7e8376504ddd8996b46ba9d6dd79c958d0ccf493ce22a70499e4e66f8d41

Download Submit
memory/464-79-0x00000000000B0000-0x00000000000BF000-memory.dmp

Filesize
60KB

Download
memory/464-72-0x00000000000A0000-0x00000000000AF000-memory.dmp

Filesize
60KB

Download
memory/464-76-0x00000000000A0000-0x00000000000AF000-memory.dmp

Filesize
60KB

Download
memory/464-78-0x0000000000090000-0x000000000009C000-memory.dmp

Filesize
48KB

Download
memory/464-83-0x00000000000B0000-0x00000000000BF000-memory.dmp

Filesize
60KB

Download
memory/464-82-0x0000000000090000-0x000000000009C000-memory.dmp

Filesize
48KB

Download
memory/1212-60-0x0000000002630000-0x000000000263F000-memory.dmp

Filesize
60KB

Download
memory/1212-66-0x0000000002220000-0x000000000222C000-memory.dmp

Filesize
48KB

Download
memory/1212-56-0x0000000002630000-0x000000000263F000-memory.dmp

Filesize
60KB

Download
memory/1212-64-0x0000000002630000-0x000000000263F000-memory.dmp

Filesize
60KB

Download
memory/1212-81-0x0000000002220000-0x000000000222C000-memory.dmp

Filesize
48KB

Download
memory/1212-67-0x0000000002640000-0x000000000264F000-memory.dmp

Filesize
60KB

Download
memory/1524-84-0x0000000000000000-mapping.dmp

Download
memory/1688-55-0x00000000003C0000-0x00000000003F7000-memory.dmp

Filesize
220KB

Download
memory/1688-80-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1688-65-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1688-85-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1688-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing