fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e

General

Target

fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Size

370KB
MD5

a80bf9cba80fa69b7612b5947b197723
SHA1

07622081d530608ac6619b6b25b75a5a7b820cad
SHA256

fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e
SHA512

ad761f4b86b52989f091e323dad2ff681a0dc8de1571aa71898d002e8fab0dde431daab8e7334674502bc4caf4d1a7bfdf21a0863335d768f6e042bf627fbbb5
SSDEEP

6144:3q8UWDkUi7jDLaC7G5QGiUlSFYcH+WNEvWZR+GoqjoOLo6+WYg:RRgUG7aC7G6GQH5NFZR+GooY6Yg

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MessageService	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MessageService = "C:\\ProgramData\\mqtgsvc.exe"	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cisvc	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cisvc = "C:\\Windows\\System32\\drivers\\cisvc.exe"	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\RCXF15A.tmp	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
File created	C:\Windows\SysWOW64\drivers\cisvc.exe	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
File opened for modification	C:\Windows\SysWOW64\drivers\cisvc.exe	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe

Executes dropped EXE 1 IoCs

pid	Process
4884	dllhost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Csrss	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Csrss = "C:\\Users\\Admin\\AppData\\Roaming\\csrss.exe"	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinInit	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinInit = "C:\\Users\\Admin\\Local Settings\\Application Data\\wininit.exe"	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~3\MICROS~1\mstinit.exe	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
File opened for modification	C:\PROGRA~3\MICROS~1\RCXF40D.tmp	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft RSVP	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Microsoft RSVP = "C:\\Users\\Admin\\AppData\\Roaming\\rsvp.exe"	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\DCOM	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Key created	\REGISTRY\USER\.DEFAULT	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\DCOM = "C:\\ProgramData\\Microsoft\\dllhost.exe"	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 4884	4236	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe	78
PID 4236 wrote to memory of 4884	4236	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe	78
PID 4236 wrote to memory of 4884	4236	fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe	78

C:\Users\Admin\AppData\Local\Temp\fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe
"C:\Users\Admin\AppData\Local\Temp\fed5e28f5d6ca5f2e7f5a5b60cb1ccabd653fea0053a1cee440f7ee2c9262d6e.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4236
- C:\ProgramData\Microsoft\dllhost.exe
  C:\ProgramData\Microsoft\dllhost.exe /a 1
  2⤵
  - Executes dropped EXE
  PID:4884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\dllhost.exe

Filesize
370KB

MD5
540bd1221774781daed69dabffdbd080

SHA1
61c9277360cf36cbf966555f942880afc6630fc4

SHA256
638e3469f73725c390830e19cdc836a3bf7a9361afea7c9641015f8cf49dd603

SHA512
05845346fd84e9e5b601e5ec50c8caf33c0c92c35bfeb41d7c9ac4efb592d74c2addeb9870f2723674cac5eb2e1c3a417afa4de40ba128ec0081a8d2b89def86

Download Submit
C:\ProgramData\Microsoft\dllhost.exe

Filesize
370KB

MD5
540bd1221774781daed69dabffdbd080

SHA1
61c9277360cf36cbf966555f942880afc6630fc4

SHA256
638e3469f73725c390830e19cdc836a3bf7a9361afea7c9641015f8cf49dd603

SHA512
05845346fd84e9e5b601e5ec50c8caf33c0c92c35bfeb41d7c9ac4efb592d74c2addeb9870f2723674cac5eb2e1c3a417afa4de40ba128ec0081a8d2b89def86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Twain002.Mtx

Filesize
10B

MD5
32ea4dba965a131e2f431fcb7629d5bd

SHA1
f9ca1c28dd758fbfee566d65631c8b438d3f1bb9

SHA256
474d4b2db9784f687ea9e6b1301c89643aaac25cd819670de57fe250188ab582

SHA512
5c7d0d5d8fa61c3b606b8205df9d29e0a633d6f3ee85f807948555e760ebc7119c80bd66cc19ad702e4f00318d1841c7c38a5332a4d96716184b6f7c6bda13b4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads