981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5

Reason

Machine shutdown

General

Target

981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe
Size

42KB
MD5

84332e26f9592cc234d59975497e52d3
SHA1

33d754e60810729a67b2d5c300679b1c49e772bf
SHA256

981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5
SHA512

94ece2482d4b2b8eeab2dce9a88b8bd2bff325a83b69639359aded1ba304cb3758d292c056930e918766946816124a5f75c3ce7115ce06bbcb407e532712a082
SSDEEP

768:X5DZ2h94FnpQPn4NSmRFm3qtWiUCb+BHPSNJCTGriVVBonMcFqed6tIDsox:np64jg6tWiUCbnN1GzonMcFR66D

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	WmInit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	WmInit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	WmInit.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	WmInit.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\WmInit.exe = "C:\\Windows\\SysWOW64\\WmInit.exe:*:Enabled:Microsoft Windows Media"	WmInit.exe

Executes dropped EXE 1 IoCs

pid	Process
2664	WmInit.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	WmInit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Media = "C:\\Windows\\SysWOW64\\WmInit.exe"	WmInit.exe

Drops file in System32 directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tmp	981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe
File created	C:\Windows\SysWOW64\WmInit.dat	981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe
File opened for modification	C:\Windows\SysWOW64\tmp	WmInit.exe
File created	C:\Windows\SysWOW64\tmp	WmInit.exe
File opened for modification	\??\c:\windows\SysWOW64\lsass.exe	WmInit.exe
File opened for modification	\??\c:\windows\SysWOW64\spoolsv.exe	WmInit.exe
File opened for modification	\??\c:\windows\SysWOW64\dllhost.exe	WmInit.exe
File opened for modification	C:\Windows\SysWOW64\tmp	981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe
File opened for modification	C:\Windows\SysWOW64\WmInit.exe	981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe
File created	C:\Windows\SysWOW64\WmInit.exe	981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2664	WmInit.exe
2664	WmInit.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	WmInit.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2736 wrote to memory of 2664	2736	981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe	79
PID 2736 wrote to memory of 2664	2736	981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe	79
PID 2736 wrote to memory of 2664	2736	981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe	79

C:\Users\Admin\AppData\Local\Temp\981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe
"C:\Users\Admin\AppData\Local\Temp\981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\SysWOW64\WmInit.exe
  "C:\Windows\system32\WmInit.exe" "C:\Users\Admin\AppData\Local\Temp\981c60bf3c983d682b6ee7ac4492f61a752e75d004b5c0730a941f8af6ff0fc5.exe"
  2⤵
  - Modifies firewall policy service
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2664

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\WmInit.dat

Filesize
8B

MD5
22812ea6ce7128a6162465e77bcf144c

SHA1
26188d673f76ad9cf5f37d279c61bd9a52257330

SHA256
06a6ff909305e1e628af28279bbae5631b6af7d0856660a1e8529bb1f21b420b

SHA512
444c7e17aa6f9c64e90e7dc021a861c4d4abb1a9b192e3e6cc0e7af4e6f3100a82060d8952fb8350b6b3514839eeead35e9d61537e92eda4d086620819086bf4

Download Submit
C:\Windows\SysWOW64\WmInit.exe

Filesize
33.4MB

MD5
d332c7e279ad86fad7ac42a8f2c56a91

SHA1
a54465620bee4e50f8f970bcb31d0c4a975d0a85

SHA256
92dc775dd15a5f095f3f3a40a381439a1395fea16b0b1cc282e3ec3d9fc55cb6

SHA512
cb348855adb75548ea286c35cb361c437caed0a5b5bec1bcca0af11d89bd614b17545d530546aa2bc77b72de3cb66546f5f6ebe49d2395a3a1db24ad4b321fc8

Download Submit
C:\Windows\SysWOW64\WmInit.exe

Filesize
33.4MB

MD5
d332c7e279ad86fad7ac42a8f2c56a91

SHA1
a54465620bee4e50f8f970bcb31d0c4a975d0a85

SHA256
92dc775dd15a5f095f3f3a40a381439a1395fea16b0b1cc282e3ec3d9fc55cb6

SHA512
cb348855adb75548ea286c35cb361c437caed0a5b5bec1bcca0af11d89bd614b17545d530546aa2bc77b72de3cb66546f5f6ebe49d2395a3a1db24ad4b321fc8

Download Submit
memory/2664-139-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/2664-140-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/2736-132-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/2736-133-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download
memory/2736-137-0x0000000000400000-0x000000000050A000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads