f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

General

Target

f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Size

87KB
MD5

8927cc035ad4a15f0d35979a03cedcce
SHA1

477413083fb79852dcabbba3b6946c48ac75335d
SHA256

f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db
SHA512

087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c
SSDEEP

1536:y4AsCrIt4wxlIh4ltuKna2a6ycobMP65aj5/b:yL/It9jZla2Ka4aj5/

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IEudinit = "C:\\Users\\Admin\\LOCALS~1\\APPLIC~1\\ieudinit.exe /waitservice"	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\IEudinit = "C:\\Windows\\ieudinit.exe /waitservice"	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe

Executes dropped EXE 1 IoCs

pid	Process
1964	cisvc.exe

Loads dropped DLL 2 IoCs

pid	Process
1764	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
1764	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ieudinit.exe	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
File opened for modification	C:\Windows\ieudinit.exe	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MqtgSVC = "C:\\Users\\Admin\\LOCALS~1\\APPLIC~1\\MICROS~1\\mqtgsvc.exe /waitservice"	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 1964	1764	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe	28
PID 1764 wrote to memory of 1964	1764	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe	28
PID 1764 wrote to memory of 1964	1764	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe	28
PID 1764 wrote to memory of 1964	1764	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe	28

C:\Users\Admin\AppData\Local\Temp\f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
"C:\Users\Admin\AppData\Local\Temp\f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe"
1⤵
- Adds policy Run key to start application
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Users\Admin\LOCALS~1\APPLIC~1\MICROS~1\cisvc.exe
  C:\Users\Admin\LOCALS~1\APPLIC~1\MICROS~1\cisvc.exe /waitservice
  2⤵
  - Executes dropped EXE
  PID:1964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MICROS~1\cisvc.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit
C:\Users\Admin\LOCALS~1\APPLIC~1\MICROS~1\cisvc.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit
C:\Users\Admin\LOCALS~1\APPLIC~1\MICROS~1\mqtgsvc.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit
C:\Users\Admin\LOCALS~1\APPLIC~1\ieudinit.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit
C:\Windows\ieudinit.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit
\Users\Admin\AppData\Local\MICROS~1\cisvc.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit
\Users\Admin\AppData\Local\MICROS~1\cisvc.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit
memory/1964-62-0x0000000075BA1000-0x0000000075BA3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing