d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9

General

Target

d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
Size

357KB
MD5

ff9e6cd04d42b5b7332a22e0ee5bf829
SHA1

e1d496123cd8f7d89231028021d6c8efebffdbe4
SHA256

d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9
SHA512

dfd4f59f870e74a7ab5666c75f9176f3c48f3475b6b353c3b421f96526ef206e26824a1332ef2e3473d736bc4eee308fc682d7e285cf623cf89f64c9ef32546f
SSDEEP

6144:6774ARRL2vvUufq5dR6BN9cqHINsI4V1NNU7rBN+sV0eJMe1ShgF5R5:yjAVq5dIBlHIOIGNNU7FNpL1SWR5

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\M-5735358327358535356\winsvc.exe = "C:\\Users\\Admin\\M-5735358327358535356\\winsvc.exe:*:Enabled:Microsoft Windows Manager"	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe

Executes dropped EXE 2 IoCs

pid	Process
864	winsvc.exe
404	winsvc.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4168-132-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/4168-133-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/memory/4168-134-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/files/0x0007000000022e04-141.dat	upx
behavioral2/files/0x0007000000022e04-142.dat	upx
behavioral2/memory/864-143-0x0000000000400000-0x00000000004E9000-memory.dmp	upx
behavioral2/files/0x0007000000022e04-146.dat	upx
behavioral2/memory/864-148-0x0000000000400000-0x00000000004E9000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Users\\Admin\\M-5735358327358535356\\winsvc.exe"	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4168 set thread context of 3464	4168	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	85
PID 864 set thread context of 404	864	winsvc.exe	89

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 3464	4168	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	85
PID 4168 wrote to memory of 3464	4168	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	85
PID 4168 wrote to memory of 3464	4168	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	85
PID 4168 wrote to memory of 3464	4168	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	85
PID 4168 wrote to memory of 3464	4168	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	85
PID 4168 wrote to memory of 3464	4168	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	85
PID 4168 wrote to memory of 3464	4168	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	85
PID 4168 wrote to memory of 3464	4168	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	85
PID 4168 wrote to memory of 3464	4168	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	85
PID 4168 wrote to memory of 3464	4168	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	85
PID 3464 wrote to memory of 864	3464	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	88
PID 3464 wrote to memory of 864	3464	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	88
PID 3464 wrote to memory of 864	3464	d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe	88
PID 864 wrote to memory of 404	864	winsvc.exe	89
PID 864 wrote to memory of 404	864	winsvc.exe	89
PID 864 wrote to memory of 404	864	winsvc.exe	89
PID 864 wrote to memory of 404	864	winsvc.exe	89
PID 864 wrote to memory of 404	864	winsvc.exe	89
PID 864 wrote to memory of 404	864	winsvc.exe	89
PID 864 wrote to memory of 404	864	winsvc.exe	89
PID 864 wrote to memory of 404	864	winsvc.exe	89
PID 864 wrote to memory of 404	864	winsvc.exe	89
PID 864 wrote to memory of 404	864	winsvc.exe	89

C:\Users\Admin\AppData\Local\Temp\d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
"C:\Users\Admin\AppData\Local\Temp\d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Temp\d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe
  "C:\Users\Admin\AppData\Local\Temp\d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9.exe"
  2⤵
  - Modifies firewall policy service
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Users\Admin\M-5735358327358535356\winsvc.exe
    C:\Users\Admin\M-5735358327358535356\winsvc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:864
  - - C:\Users\Admin\M-5735358327358535356\winsvc.exe
      C:\Users\Admin\M-5735358327358535356\winsvc.exe
      4⤵
      Executes dropped EXE
      PID:404

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\M-5735358327358535356\winsvc.exe

Filesize
357KB

MD5
ff9e6cd04d42b5b7332a22e0ee5bf829

SHA1
e1d496123cd8f7d89231028021d6c8efebffdbe4

SHA256
d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9

SHA512
dfd4f59f870e74a7ab5666c75f9176f3c48f3475b6b353c3b421f96526ef206e26824a1332ef2e3473d736bc4eee308fc682d7e285cf623cf89f64c9ef32546f

Download Submit
C:\Users\Admin\M-5735358327358535356\winsvc.exe

Filesize
357KB

MD5
ff9e6cd04d42b5b7332a22e0ee5bf829

SHA1
e1d496123cd8f7d89231028021d6c8efebffdbe4

SHA256
d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9

SHA512
dfd4f59f870e74a7ab5666c75f9176f3c48f3475b6b353c3b421f96526ef206e26824a1332ef2e3473d736bc4eee308fc682d7e285cf623cf89f64c9ef32546f

Download Submit
C:\Users\Admin\M-5735358327358535356\winsvc.exe

Filesize
357KB

MD5
ff9e6cd04d42b5b7332a22e0ee5bf829

SHA1
e1d496123cd8f7d89231028021d6c8efebffdbe4

SHA256
d95714e375d3843cd20a7b37763505f519357eb1940e17a5cbd337f9e6e6f8c9

SHA512
dfd4f59f870e74a7ab5666c75f9176f3c48f3475b6b353c3b421f96526ef206e26824a1332ef2e3473d736bc4eee308fc682d7e285cf623cf89f64c9ef32546f

Download Submit
memory/404-150-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/404-149-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/404-144-0x0000000000000000-mapping.dmp

Download
memory/864-140-0x0000000000000000-mapping.dmp

Download
memory/864-143-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/864-148-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/3464-139-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3464-138-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3464-137-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3464-136-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/3464-135-0x0000000000000000-mapping.dmp

Download
memory/4168-132-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/4168-134-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download
memory/4168-133-0x0000000000400000-0x00000000004E9000-memory.dmp

Filesize
932KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads