3c1562b977d267e4c23e3913e1cc796018a56532fcc5a0e2a201ffafef8556d2

General

Target

Server.exe
Size

742KB
MD5

546957b760a3c3d6a2b6810320046cef
SHA1

d2ad30ec9b63aef4610188b4720067a3add6345c
SHA256

9b47cbacf3a0d3543c85f1c349e4a15793c41d29ce4d113a547b05b4c64aaea1
SHA512

585115e482a7cfa13165392ff387ad85eff2a47aacb442f844d173aaa2430434671a293d3278c061bbee077a6786d2ee5c7c9c73fa1d0fc047d165df0279d9dd
SSDEEP

12288:4RyTY+2U4uan/8RdW5A0zyxuJwQ5oAlK+Gx9vZuIkAbQQ52LYRg08y5rDRp:86iU4ucwdW5A2RJr/k39vcIkA33P

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4824	Hacker.com.cn.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27	Hacker.com.cn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27	Hacker.com.cn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273	Hacker.com.cn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	Hacker.com.cn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	Hacker.com.cn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	Hacker.com.cn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	Hacker.com.cn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_C1D494D2F32AEDC4FBA6C14F3F436273	Hacker.com.cn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	Hacker.com.cn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	Hacker.com.cn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	Hacker.com.cn.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\pRogram Files\Hacker.com.cn.exe	Server.exe
File opened for modification	C:\pRogram Files\Hacker.com.cn.exe	Server.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.BAT	Server.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\P3P\History	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Hacker.com.cn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	Hacker.com.cn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	Hacker.com.cn.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3260	Server.exe
Token: SeDebugPrivilege	4824	Hacker.com.cn.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4824	Hacker.com.cn.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 4900	3260	Server.exe	80
PID 3260 wrote to memory of 4900	3260	Server.exe	80
PID 3260 wrote to memory of 4900	3260	Server.exe	80

C:\Users\Admin\AppData\Local\Temp\Server.exe
"C:\Users\Admin\AppData\Local\Temp\Server.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.BAT
  2⤵
  PID:4900

C:\pRogram Files\Hacker.com.cn.exe
"C:\pRogram Files\Hacker.com.cn.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4824

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Hacker.com.cn.exe

Filesize
742KB

MD5
546957b760a3c3d6a2b6810320046cef

SHA1
d2ad30ec9b63aef4610188b4720067a3add6345c

SHA256
9b47cbacf3a0d3543c85f1c349e4a15793c41d29ce4d113a547b05b4c64aaea1

SHA512
585115e482a7cfa13165392ff387ad85eff2a47aacb442f844d173aaa2430434671a293d3278c061bbee077a6786d2ee5c7c9c73fa1d0fc047d165df0279d9dd

Download Submit
C:\Windows\uninstal.BAT

Filesize
138B

MD5
6eb475c6df56df79d4d4efb8d8af828a

SHA1
d3e0ee51bd87f3688b34bfaa8b017446b08e758c

SHA256
fafc571285bddaf3e1a3562b4d9691f68e8f5f00e59191d791949a1301920a9e

SHA512
6d00694c7f1cbac8776143f08145a42a48cfbe352168739b29d9ccea4025609bc97751836234d952eceed961f6bc2872434a41968365a0e631b39e6b2bdbc2dd

Download Submit
C:\pRogram Files\Hacker.com.cn.exe

Filesize
742KB

MD5
546957b760a3c3d6a2b6810320046cef

SHA1
d2ad30ec9b63aef4610188b4720067a3add6345c

SHA256
9b47cbacf3a0d3543c85f1c349e4a15793c41d29ce4d113a547b05b4c64aaea1

SHA512
585115e482a7cfa13165392ff387ad85eff2a47aacb442f844d173aaa2430434671a293d3278c061bbee077a6786d2ee5c7c9c73fa1d0fc047d165df0279d9dd

Download Submit
memory/3260-132-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/3260-137-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4824-135-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/4824-139-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download

Analysis

Sharing