a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83

General

Target

a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Size

416KB
MD5

acb806b971d7ff0a4af77df4facbbdd7
SHA1

97af051f25e285ae1ba3af2ec1b4506001136808
SHA256

a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83
SHA512

1c274d214eb35df329c34af8f55d50c318b7467fe7069be84c84b6de95a65857225de60d3ccc46c054a260fdbe5ae633bb9bfa70db41d11fac2eaf2d1db90b8b
SSDEEP

12288:N7ihipiOvv+8LuyhMqrGbBilF5q+iIL8:N7Cilv8yvrGwlF5q+6

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MessageService	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MessageService = "C:\\Windows\\System\\mqtgsvc.exe"	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DCOM	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DCOM = "C:\\Users\\Admin\\AppData\\Roaming\\dllhost.exe"	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\cisvc.exe	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
File opened for modification	C:\Windows\SysWOW64\drivers\RCXAA8E.tmp	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
File created	C:\Windows\SysWOW64\drivers\mqtgsvc.exe	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
File opened for modification	C:\Windows\SysWOW64\drivers\RCXAB4D.tmp	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe

Executes dropped EXE 1 IoCs

pid	Process
1380	cisvc.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cisvc	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cisvc = "C:\\Windows\\System32\\drivers\\cisvc.exe"	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Session Manager	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Session Manager = "C:\\Users\\Admin\\AppData\\Roaming\\smss.exe"	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\System\mqtgsvc.exe	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
File opened for modification	C:\Windows\System\mqtgsvc.exe	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
File opened for modification	C:\Windows\System\RCXAA6E.tmp	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
File created	C:\Windows\System\mstsc.exe	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
File opened for modification	C:\Windows\System\RCXAB2D.tmp	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
File created	C:\Windows\logman.exe	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
File opened for modification	C:\Windows\RCXAB5F.tmp	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\Logman	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\Logman = "C:\\Windows\\logman.exe"	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MessageService	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MessageService = "C:\\ProgramData\\mqtgsvc.exe"	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1380	848	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe	78
PID 848 wrote to memory of 1380	848	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe	78
PID 848 wrote to memory of 1380	848	a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe	78

C:\Users\Admin\AppData\Local\Temp\a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe
"C:\Users\Admin\AppData\Local\Temp\a7f88deef51fa5e745bec6cc2cab29498f2da6ce124b1e3b11f81003473a7c83.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:848
- C:\Windows\SysWOW64\drivers\cisvc.exe
  C:\Windows\System32\drivers\cisvc.exe /a 1
  2⤵
  - Executes dropped EXE
  PID:1380

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Twain002.Mtx

Filesize
9B

MD5
a715e72e7158ca8aa7807b44683ea751

SHA1
77e9b3b24f8d48e5496725b60438fa1f96baf019

SHA256
04ed61c545d53e93960c0a67576c136d6f7e84a9630ec6567ee918f5fb0486a2

SHA512
164100bf0b083b089b231fcdf3d8a29ac4bb1b53c20b8b95c4b0a5107154e29a4eaea35e9c28e54fbcbfbbf789258458053403f8d3013b12421cc81047f840f0

Download Submit
C:\Windows\SysWOW64\drivers\cisvc.exe

Filesize
416KB

MD5
c19dac23819e597bdf661cccadd4d081

SHA1
4b73af3e43fc27f12a9929ee9e099b25f9d5bfd5

SHA256
7154757408ebcd1320fc8009657bbc6438ebd4ed63ae113a5d2761ea0ac14ec5

SHA512
02618ecd8c1bb48968cfa160f43d070ee90c6dee7bc1196a7b7891c194c9a56a570b566fb1e749bf30c8402f38cdfa66dc73d414a7b3b23bfe041028776dbb13

Download Submit
C:\Windows\SysWOW64\drivers\cisvc.exe

Filesize
416KB

MD5
c19dac23819e597bdf661cccadd4d081

SHA1
4b73af3e43fc27f12a9929ee9e099b25f9d5bfd5

SHA256
7154757408ebcd1320fc8009657bbc6438ebd4ed63ae113a5d2761ea0ac14ec5

SHA512
02618ecd8c1bb48968cfa160f43d070ee90c6dee7bc1196a7b7891c194c9a56a570b566fb1e749bf30c8402f38cdfa66dc73d414a7b3b23bfe041028776dbb13

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads