f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

General

Target

f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Size

87KB
MD5

8927cc035ad4a15f0d35979a03cedcce
SHA1

477413083fb79852dcabbba3b6946c48ac75335d
SHA256

f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db
SHA512

087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c
SSDEEP

1536:y4AsCrIt4wxlIh4ltuKna2a6ycobMP65aj5/b:yL/It9jZla2Ka4aj5/

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Mstsc = "C:\\Windows\\System32\\drivers\\mstsc.exe /waitservice"	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Logman = "C:\\Windows\\System32\\drivers\\logman.exe /waitservice"	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\mstsc.exe	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
File opened for modification	C:\Windows\SysWOW64\drivers\mstsc.exe	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
File created	C:\Windows\SysWOW64\drivers\logman.exe	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe

Executes dropped EXE 1 IoCs

pid	Process
1280	clipsrv.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Cisvc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cisvc.exe /waitservice"	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 1280	900	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe	80
PID 900 wrote to memory of 1280	900	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe	80
PID 900 wrote to memory of 1280	900	f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe	80

C:\Users\Admin\AppData\Local\Temp\f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe
"C:\Users\Admin\AppData\Local\Temp\f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\LOCALS~1\APPLIC~1\MICROS~1\clipsrv.exe
  C:\Users\Admin\LOCALS~1\APPLIC~1\MICROS~1\clipsrv.exe /waitservice
  2⤵
  - Executes dropped EXE
  PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\clipsrv.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\cisvc.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit
C:\Users\Admin\LOCALS~1\APPLIC~1\MICROS~1\clipsrv.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit
C:\Windows\SysWOW64\drivers\logman.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit
C:\Windows\SysWOW64\drivers\mstsc.exe

Filesize
87KB

MD5
8927cc035ad4a15f0d35979a03cedcce

SHA1
477413083fb79852dcabbba3b6946c48ac75335d

SHA256
f0f1ee43effd541e804f55ad88838948a1c47c0b72605804a7a42bfd3a4ca1db

SHA512
087b294a3f5672ff86f7e9bf409c20fa3a3f21861b5b407bd5b385c69d4e878eeb843c5a43289cb30ee0a028396e9587b266b8ede566f0234700f89c3949ce1c

Download Submit

Analysis

Sharing