21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13

General

Target

21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Size

427KB
MD5

01d8815042e43612391f519406c51d40
SHA1

b693364b39812a4cbc082b4d7dacaa582da7e0cd
SHA256

21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13
SHA512

c7c03a096df95a321d63fcc4ca83bf518ac6a2d03f1afafb18eb131bf138c2d89dab38747ac9a9c46e1d67af2f4734b46d9da06ce066a7f7b9ae6eb8a9a1839a
SSDEEP

12288:NhNa7JySNwf7bQJ586JveE8l/dZfJzFpcXYpjYLOHD:NU5wf7bDdF8Ypjs

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DCOM = "C:\\Windows\\System32\\drivers\\dllhost.exe"	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Logman	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Logman = "C:\\Users\\Admin\\Local Settings\\Application Data\\Microsoft\\Windows\\logman.exe"	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DCOM	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\dllhost.exe	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
File opened for modification	C:\Windows\SysWOW64\drivers\RCX468E.tmp	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
File created	C:\Windows\SysWOW64\drivers\clipsrv.exe	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
File opened for modification	C:\Windows\SysWOW64\drivers\RCX5049.tmp	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
File created	C:\Windows\SysWOW64\drivers\dllhost.exe	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe

Executes dropped EXE 1 IoCs

pid	Process
2876	winlogon.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinLogon	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinLogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe"	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Sessmgr	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Sessmgr = "C:\\Users\\Admin\\Local Settings\\Application Data\\Microsoft\\Windows\\sessmgr.exe"	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System\rsvp.exe	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
File opened for modification	C:\Windows\System\RCX4F4E.tmp	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ClipSrv = "C:\\Windows\\System32\\drivers\\clipsrv.exe"	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\Task Scheduler	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Key created	\REGISTRY\USER\.DEFAULT	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ClipSrv	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\Task Scheduler = "C:\\Users\\Admin\\Local Settings\\Application Data\\Microsoft\\Windows\\mstinit.exe"	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2876	1760	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe	81
PID 1760 wrote to memory of 2876	1760	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe	81
PID 1760 wrote to memory of 2876	1760	21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe	81

C:\Users\Admin\AppData\Local\Temp\21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe
"C:\Users\Admin\AppData\Local\Temp\21a4ab34cb00fcfabd21bb5215187409a0628740c742c92a049ff482bf37fb13.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Users\Admin\AppData\Roaming\winlogon.exe
  C:\Users\Admin\AppData\Roaming\winlogon.exe /a 1
  2⤵
  - Executes dropped EXE
  PID:2876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Twain002.Mtx

Filesize
10B

MD5
d7edf5d9cdd08ffb4fdab2b1be38999f

SHA1
b63f4bdb501fa31ff35a9b9bd0bfdc18f87a5e27

SHA256
c5d79148aa800d4c8592285148b278614ea60488b0b116a156714f4aee271397

SHA512
30a98610f19491abc2893e86d3b2e1926f83feabb41cf54d9e932f68fa7300d469355ab12e1a9018333835f7674ee0a84e16fb8202c33ae55ee11f316958fd5a

Download Submit
C:\Users\Admin\AppData\Roaming\winlogon.exe

Filesize
427KB

MD5
ad68a4bc892ed9f5ff8dc7f07a18635f

SHA1
59577177dd1d09ff975cd449092ad8d4dafa31ec

SHA256
1c32e57014049fb28d864125a3273f3e01f540af4155df7d398023c5cf981b66

SHA512
bfd8f9ab60cebca89ad1c1c5d1d2005bd4823d1d216d440a4c97d6ee5243bd37ffe13273b5a438df20824b35b2205f200eb82178322226e9d1b637d5044055a3

Download Submit
C:\Users\Admin\AppData\Roaming\winlogon.exe

Filesize
427KB

MD5
ad68a4bc892ed9f5ff8dc7f07a18635f

SHA1
59577177dd1d09ff975cd449092ad8d4dafa31ec

SHA256
1c32e57014049fb28d864125a3273f3e01f540af4155df7d398023c5cf981b66

SHA512
bfd8f9ab60cebca89ad1c1c5d1d2005bd4823d1d216d440a4c97d6ee5243bd37ffe13273b5a438df20824b35b2205f200eb82178322226e9d1b637d5044055a3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads