cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8

General

Target

cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
Size

10KB
MD5

43c3ef09e1f580efdc5d33591d4da8b2
SHA1

e6c3138e4467c1bf82bd14947d6d883b8693d08f
SHA256

cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8
SHA512

8a4523ea51878d48814452c635ccb017cc9c133c5372bedc73d2c86b9e59f296d49fc6ca678b18ac15d864dad35db56d67b38b9e5338a33ffcf493d43c0825d7
SSDEEP

192:nbiqIXsP18touF3lcfFf5yqG1HLSX9A0:biqis9Qlcffyq+ef

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Runonce = "C:\\Windows\\system32\\runouce.exe"	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\runouce.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Windows\SysWOW64\runouce.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.htm	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stars.htm	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\TabTip.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ConvertInkStore.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\FlickLearningWizard.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InkWatson.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Hand Prints.htm	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
File opened for modification	C:\Program Files\DVD Maker\DVDMaker.exe	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 544	2036	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe	26
PID 2036 wrote to memory of 544	2036	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe	26
PID 2036 wrote to memory of 544	2036	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe	26
PID 2036 wrote to memory of 544	2036	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe	26
PID 2036 wrote to memory of 1260	2036	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe	14
PID 2036 wrote to memory of 1260	2036	cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe	14

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
  "C:\Users\Admin\AppData\Local\Temp\cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe"
  2⤵
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Users\Admin\AppData\Local\Temp\cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe
    "C:\Users\Admin\AppData\Local\Temp\cac7f8ec6eacffa47e4b797e547a20ddebb1f0553d94bc6971b70ff24160b0d8.exe"
    3⤵
    PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1260-55-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing