d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9

General

Target

d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
Size

357KB
MD5

ff9e6cd04d42b5b7332a22e0ee5bf829
SHA1

e1d496123cd8f7d89231028021d6c8efebffdbe4
SHA256

d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9
SHA512

dfd4f59f870e74a7ab5666c75f9176f3c48f3475b6b353c3b421f96526ef206e26824a1332ef2e3473d736bc4eee308fc682d7e285cf623cf89f64c9ef32546f
SSDEEP

6144:6774ARRL2vvUufq5dR6BN9cqHINsI4V1NNU7rBN+sV0eJMe1ShgF5R5:yjAVq5dIBlHIOIGNNU7FNpL1SWR5

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\M-5735358327358535356\winsvc.exe = "C:\\Users\\Admin\\M-5735358327358535356\\winsvc.exe:*:Enabled:Microsoft Windows Manager"	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe

Executes dropped EXE 2 IoCs

pid	Process
576	winsvc.exe
376	winsvc.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1564-54-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/1564-66-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/files/0x000a0000000122e9-68.dat	upx
behavioral1/files/0x000a0000000122e9-70.dat	upx
behavioral1/memory/576-72-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/memory/576-83-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral1/files/0x000a0000000122e9-84.dat	upx

Loads dropped DLL 1 IoCs

pid	Process
1252	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Users\\Admin\\M-5735358327358535356\\winsvc.exe"	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1564 set thread context of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 576 set thread context of 376	576	winsvc.exe	30

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 1564 wrote to memory of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 1564 wrote to memory of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 1564 wrote to memory of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 1564 wrote to memory of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 1564 wrote to memory of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 1564 wrote to memory of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 1564 wrote to memory of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 1564 wrote to memory of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 1564 wrote to memory of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 1564 wrote to memory of 1252	1564	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	28
PID 1252 wrote to memory of 576	1252	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	29
PID 1252 wrote to memory of 576	1252	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	29
PID 1252 wrote to memory of 576	1252	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	29
PID 1252 wrote to memory of 576	1252	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	29
PID 576 wrote to memory of 376	576	winsvc.exe	30
PID 576 wrote to memory of 376	576	winsvc.exe	30
PID 576 wrote to memory of 376	576	winsvc.exe	30
PID 576 wrote to memory of 376	576	winsvc.exe	30
PID 576 wrote to memory of 376	576	winsvc.exe	30
PID 576 wrote to memory of 376	576	winsvc.exe	30
PID 576 wrote to memory of 376	576	winsvc.exe	30
PID 576 wrote to memory of 376	576	winsvc.exe	30
PID 576 wrote to memory of 376	576	winsvc.exe	30
PID 576 wrote to memory of 376	576	winsvc.exe	30
PID 576 wrote to memory of 376	576	winsvc.exe	30

C:\Users\Admin\AppData\Local\Temp\d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
"C:\Users\Admin\AppData\Local\Temp\d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Users\Admin\AppData\Local\Temp\d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
  "C:\Users\Admin\AppData\Local\Temp\d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe"
  2⤵
  - Modifies firewall policy service
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Users\Admin\M-5735358327358535356\winsvc.exe
    C:\Users\Admin\M-5735358327358535356\winsvc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Users\Admin\M-5735358327358535356\winsvc.exe
      C:\Users\Admin\M-5735358327358535356\winsvc.exe
      4⤵
      Executes dropped EXE
      PID:376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\M-5735358327358535356\winsvc.exe

Filesize
357KB

MD5
ff9e6cd04d42b5b7332a22e0ee5bf829

SHA1
e1d496123cd8f7d89231028021d6c8efebffdbe4

SHA256
d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9

SHA512
dfd4f59f870e74a7ab5666c75f9176f3c48f3475b6b353c3b421f96526ef206e26824a1332ef2e3473d736bc4eee308fc682d7e285cf623cf89f64c9ef32546f

Download Submit
C:\Users\Admin\M-5735358327358535356\winsvc.exe

Filesize
357KB

MD5
ff9e6cd04d42b5b7332a22e0ee5bf829

SHA1
e1d496123cd8f7d89231028021d6c8efebffdbe4

SHA256
d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9

SHA512
dfd4f59f870e74a7ab5666c75f9176f3c48f3475b6b353c3b421f96526ef206e26824a1332ef2e3473d736bc4eee308fc682d7e285cf623cf89f64c9ef32546f

Download Submit
\Users\Admin\M-5735358327358535356\winsvc.exe

Filesize
357KB

MD5
ff9e6cd04d42b5b7332a22e0ee5bf829

SHA1
e1d496123cd8f7d89231028021d6c8efebffdbe4

SHA256
d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9

SHA512
dfd4f59f870e74a7ab5666c75f9176f3c48f3475b6b353c3b421f96526ef206e26824a1332ef2e3473d736bc4eee308fc682d7e285cf623cf89f64c9ef32546f

Download Submit
memory/576-83-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/576-72-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1252-61-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1252-65-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1252-67-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1252-63-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1252-71-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1252-62-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1252-60-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1252-59-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1252-56-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1564-66-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1564-54-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/1564-55-0x0000000075611000-0x0000000075613000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads