e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb

General

Target

e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
Size

195KB
MD5

66cbfe01574c9d36ac7b098928ad839f
SHA1

99acd5bbe39713bdeba06289b6d8ba4121105deb
SHA256

e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb
SHA512

1359904ae4dcca15ef7f37c0b6f74110fe0bdf690828160f0c5b7c147a7aafd725cfccd566b1efa001d4ff2b4ec231fa9441ceaaf1602fdc57960fd784584d4b
SSDEEP

3072:/FfzYE84mr/TgyaSXWKfrsisJk90VKZ4BHQ9udt7y9+fMKO1fhSsg7+:/xzf8lr/OSXWyrsr2MjHQ9RFA

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies security service 2 TTPs 18 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32"	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap	services.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP	services.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters	services.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{8c508dde-2ce9-92e3-5b79-435a5d2d0943}\\n."	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe

Deletes itself 1 IoCs

pid	Process
1624	cmd.exe

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1984 set thread context of 1624	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe	28

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{8c508dde-2ce9-92e3-5b79-435a5d2d0943}\@	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
File created	C:\Windows\Installer\{8c508dde-2ce9-92e3-5b79-435a5d2d0943}\n	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{8c508dde-2ce9-92e3-5b79-435a5d2d0943}\\n."	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\clsid	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
472	services.exe
1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1216	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
Token: SeDebugPrivilege	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
Token: SeDebugPrivilege	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
Token: SeDebugPrivilege	472	services.exe
Token: SeBackupPrivilege	472	services.exe
Token: SeRestorePrivilege	472	services.exe
Token: SeSecurityPrivilege	472	services.exe
Token: SeTakeOwnershipPrivilege	472	services.exe
Token: SeBackupPrivilege	472	services.exe
Token: SeRestorePrivilege	472	services.exe
Token: SeSecurityPrivilege	472	services.exe
Token: SeTakeOwnershipPrivilege	472	services.exe
Token: SeBackupPrivilege	472	services.exe
Token: SeRestorePrivilege	472	services.exe
Token: SeSecurityPrivilege	472	services.exe
Token: SeTakeOwnershipPrivilege	472	services.exe
Token: SeBackupPrivilege	472	services.exe
Token: SeRestorePrivilege	472	services.exe
Token: SeSecurityPrivilege	472	services.exe
Token: SeTakeOwnershipPrivilege	472	services.exe
Token: SeShutdownPrivilege	1216	Explorer.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1216	Explorer.EXE
1216	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1216	Explorer.EXE
1216	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1216	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe	15
PID 1984 wrote to memory of 1216	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe	15
PID 1984 wrote to memory of 472	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe	2
PID 1984 wrote to memory of 1624	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe	28
PID 1984 wrote to memory of 1624	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe	28
PID 1984 wrote to memory of 1624	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe	28
PID 1984 wrote to memory of 1624	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe	28
PID 1984 wrote to memory of 1624	1984	e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe	28

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:472

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1216
- C:\Users\Admin\AppData\Local\Temp\e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe
  "C:\Users\Admin\AppData\Local\Temp\e092ca87a4e2fc3ec9116e61a4bc4ad4625df75895055027c07efe202d8058eb.exe"
  2⤵
  - Registers COM server for autorun
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe"
    3⤵
    - Deletes itself
    PID:1624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\systemroot\Installer\{8c508dde-2ce9-92e3-5b79-435a5d2d0943}\@

Filesize
2KB

MD5
05455a89a0cf200b28c4b4f14f758177

SHA1
48a1a356e4a12be19070498079540e9d2fe13583

SHA256
c6fadec65f5ea79e1bfc2c5ce7f082f8ae37e86f3922a082bf905089f74aca18

SHA512
022a82f453c254e7f5b935effe2a3f72d6ff29f9a1edafb8c15c784227a91d2a0343bd07505f55b456d389785d6f18ed422e8462e41f0275e00ff87c8e685a44

Download Submit
memory/472-71-0x0000000000210000-0x000000000021F000-memory.dmp

Filesize
60KB

Download
memory/472-80-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/472-77-0x0000000000220000-0x000000000022F000-memory.dmp

Filesize
60KB

Download
memory/472-76-0x00000000001F0000-0x00000000001FC000-memory.dmp

Filesize
48KB

Download
memory/472-75-0x0000000000210000-0x000000000021F000-memory.dmp

Filesize
60KB

Download
memory/1216-64-0x00000000025C0000-0x00000000025CF000-memory.dmp

Filesize
60KB

Download
memory/1216-66-0x00000000025D0000-0x00000000025DF000-memory.dmp

Filesize
60KB

Download
memory/1216-65-0x00000000025A0000-0x00000000025AC000-memory.dmp

Filesize
48KB

Download
memory/1216-56-0x00000000025C0000-0x00000000025CF000-memory.dmp

Filesize
60KB

Download
memory/1216-79-0x00000000025A0000-0x00000000025AC000-memory.dmp

Filesize
48KB

Download
memory/1216-60-0x00000000025C0000-0x00000000025CF000-memory.dmp

Filesize
60KB

Download
memory/1984-55-0x0000000000230000-0x0000000000266000-memory.dmp

Filesize
216KB

Download
memory/1984-78-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1984-54-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/1984-83-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download

Analysis

Sharing