9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

Analysis

max time kernel
150s
max time network
79s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 07:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe
Size

21KB
MD5

0b1d5f1bde594f3e3eac3504ee0e7e32
SHA1

6644668a533fdd12c2e9f6f213ab85b6cf34bb8e
SHA256

9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796
SHA512

f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2
SSDEEP

384:ye29rWnoK+A0I2Ux0P0wBpd5QmW7BDDSgInnnnnnnnnnnnnnnnnnnnnnnnnnnnnB:yN/t4mzBpd5G5SnnnnnnnnnnnnnnnnnB

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1508	seres.exe
848	svcst.exe
1364	svcst.exe

Loads dropped DLL 6 IoCs

pid	Process
1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe
1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe
1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe
1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe
1508	seres.exe
1508	seres.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\mserv = "C:\\Users\\Admin\\AppData\\Roaming\\seres.exe"	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svcst.exe"	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svcst.exe"	seres.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download	seres.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	seres.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	seres.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	svcst.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	svcst.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	svcst.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download	svcst.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download	svcst.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	svcst.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
848	svcst.exe
848	svcst.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
848	svcst.exe
848	svcst.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1508	1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe	27
PID 1092 wrote to memory of 1508	1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe	27
PID 1092 wrote to memory of 1508	1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe	27
PID 1092 wrote to memory of 1508	1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe	27
PID 1092 wrote to memory of 848	1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe	28
PID 1092 wrote to memory of 848	1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe	28
PID 1092 wrote to memory of 848	1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe	28
PID 1092 wrote to memory of 848	1092	9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe	28
PID 1508 wrote to memory of 1364	1508	seres.exe	29
PID 1508 wrote to memory of 1364	1508	seres.exe	29
PID 1508 wrote to memory of 1364	1508	seres.exe	29
PID 1508 wrote to memory of 1364	1508	seres.exe	29

C:\Users\Admin\AppData\Local\Temp\9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe
"C:\Users\Admin\AppData\Local\Temp\9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Roaming\seres.exe
  C:\Users\Admin\AppData\Roaming\seres.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Users\Admin\AppData\Roaming\svcst.exe
    C:\Users\Admin\AppData\Roaming\svcst.exe
    3⤵
    - Executes dropped EXE
    - Modifies Internet Explorer settings
    PID:1364
- C:\Users\Admin\AppData\Roaming\svcst.exe
  C:\Users\Admin\AppData\Roaming\svcst.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\seres.exe

Filesize
21KB

MD5
0b1d5f1bde594f3e3eac3504ee0e7e32

SHA1
6644668a533fdd12c2e9f6f213ab85b6cf34bb8e

SHA256
9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

SHA512
f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2

Download Submit
C:\Users\Admin\AppData\Roaming\seres.exe

Filesize
21KB

MD5
0b1d5f1bde594f3e3eac3504ee0e7e32

SHA1
6644668a533fdd12c2e9f6f213ab85b6cf34bb8e

SHA256
9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

SHA512
f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2

Download Submit
C:\Users\Admin\AppData\Roaming\svcst.exe

Filesize
21KB

MD5
0b1d5f1bde594f3e3eac3504ee0e7e32

SHA1
6644668a533fdd12c2e9f6f213ab85b6cf34bb8e

SHA256
9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

SHA512
f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2

Download Submit
C:\Users\Admin\AppData\Roaming\svcst.exe

Filesize
21KB

MD5
0b1d5f1bde594f3e3eac3504ee0e7e32

SHA1
6644668a533fdd12c2e9f6f213ab85b6cf34bb8e

SHA256
9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

SHA512
f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2

Download Submit
C:\Users\Admin\AppData\Roaming\svcst.exe

Filesize
21KB

MD5
0b1d5f1bde594f3e3eac3504ee0e7e32

SHA1
6644668a533fdd12c2e9f6f213ab85b6cf34bb8e

SHA256
9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

SHA512
f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2

Download Submit
\Users\Admin\AppData\Roaming\seres.exe

Filesize
21KB

MD5
0b1d5f1bde594f3e3eac3504ee0e7e32

SHA1
6644668a533fdd12c2e9f6f213ab85b6cf34bb8e

SHA256
9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

SHA512
f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2

Download Submit
\Users\Admin\AppData\Roaming\seres.exe

Filesize
21KB

MD5
0b1d5f1bde594f3e3eac3504ee0e7e32

SHA1
6644668a533fdd12c2e9f6f213ab85b6cf34bb8e

SHA256
9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

SHA512
f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2

Download Submit
\Users\Admin\AppData\Roaming\svcst.exe

Filesize
21KB

MD5
0b1d5f1bde594f3e3eac3504ee0e7e32

SHA1
6644668a533fdd12c2e9f6f213ab85b6cf34bb8e

SHA256
9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

SHA512
f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2

Download Submit
\Users\Admin\AppData\Roaming\svcst.exe

Filesize
21KB

MD5
0b1d5f1bde594f3e3eac3504ee0e7e32

SHA1
6644668a533fdd12c2e9f6f213ab85b6cf34bb8e

SHA256
9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

SHA512
f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2

Download Submit
\Users\Admin\AppData\Roaming\svcst.exe

Filesize
21KB

MD5
0b1d5f1bde594f3e3eac3504ee0e7e32

SHA1
6644668a533fdd12c2e9f6f213ab85b6cf34bb8e

SHA256
9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

SHA512
f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2

Download Submit
\Users\Admin\AppData\Roaming\svcst.exe

Filesize
21KB

MD5
0b1d5f1bde594f3e3eac3504ee0e7e32

SHA1
6644668a533fdd12c2e9f6f213ab85b6cf34bb8e

SHA256
9af48d460b57b4acfb05e524910153952e48dbab374aab9545995a8a5852a796

SHA512
f2d473153237594b973c7106176a392bf9381624f1f259cf5fc286d3dbccfce5fa922b6fee8d60cb9481f38f270ceb026e9a1ae99a2a477f3f99de069e343fe2

Download Submit
memory/848-73-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1092-63-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1092-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads