79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a

General

Target

79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Size

203KB
MD5

a18fe5e9acaa35bd57d7444bec6e7f8f
SHA1

b2a0d7ce4798b920f949e45207cd67c5b7497543
SHA256

79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a
SHA512

83173d0900bd7d0f6c20965f257f7da3494aee80e4d6c515116dd94553880ea94d011ba0e181170e5e1696eb9fadfcd6ba8cd401ab28281611c4f57023871447
SSDEEP

6144:PK2b38eV5Ko49ss9tp059yyVB118PgK04IEU:C2T8e2ss9Y59yyVBf8IK

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1268	Explorer.EXE
464	services.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3385717845-2518323428-350143044-1000\\$f6ae883d87b28e9233b2e7745dda3830\\n."	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$f6ae883d87b28e9233b2e7745dda3830\\n."	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe

Deletes itself 1 IoCs

pid	Process
1400	cmd.exe

Unexpected DNS network traffic destination 9 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2008 set thread context of 1400	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe	28

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$f6ae883d87b28e9233b2e7745dda3830\\n."	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\clsid	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3385717845-2518323428-350143044-1000\\$f6ae883d87b28e9233b2e7745dda3830\\n."	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
464	services.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1268	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Token: SeDebugPrivilege	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Token: SeDebugPrivilege	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
Token: SeDebugPrivilege	464	services.exe
Token: SeBackupPrivilege	464	services.exe
Token: SeRestorePrivilege	464	services.exe
Token: SeSecurityPrivilege	464	services.exe
Token: SeTakeOwnershipPrivilege	464	services.exe
Token: SeShutdownPrivilege	1268	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 1268	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe	16
PID 2008 wrote to memory of 1268	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe	16
PID 2008 wrote to memory of 464	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe	2
PID 2008 wrote to memory of 1400	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe	28
PID 2008 wrote to memory of 1400	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe	28
PID 2008 wrote to memory of 1400	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe	28
PID 2008 wrote to memory of 1400	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe	28
PID 2008 wrote to memory of 1400	2008	79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe	28

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1268
- C:\Users\Admin\AppData\Local\Temp\79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe
  "C:\Users\Admin\AppData\Local\Temp\79328536376786c7fdd306a97c79520166ebb0a38f7554fdc65434fee7b8818a.exe"
  2⤵
  - Registers COM server for autorun
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1400

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-18\$f6ae883d87b28e9233b2e7745dda3830\@

Filesize
2KB

MD5
18a860b1d644532f0c773fe30d407dc3

SHA1
15319d37ce9929d982af6585767c0cbe2dbf4e8b

SHA256
fcd086ba2cea10735413789ebdb43850b8de52bfaa25d8c4921fdee78dbc0c36

SHA512
14f5dfc47b855495903e99536cc02c3238e1e07d1f012ac5fcc99d5d24402b018c62fc11ee2720abb6a536a64ec4a776fd344604f7c22c77cb75fcbe447a79f8

Download Submit
C:\$Recycle.Bin\S-1-5-18\$f6ae883d87b28e9233b2e7745dda3830\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
C:\$Recycle.Bin\S-1-5-21-3385717845-2518323428-350143044-1000\$f6ae883d87b28e9233b2e7745dda3830\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
\$Recycle.Bin\S-1-5-18\$f6ae883d87b28e9233b2e7745dda3830\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
\$Recycle.Bin\S-1-5-21-3385717845-2518323428-350143044-1000\$f6ae883d87b28e9233b2e7745dda3830\n

Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
memory/2008-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2008-56-0x0000000000230000-0x000000000026A000-memory.dmp

Filesize
232KB

Download
memory/2008-59-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2008-63-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2008-65-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing