eebd455e5228d356cf78ddc79ec3f0a0ff5dd77f5cdaa6ba9508268eaf7ed135

General

Target

eebd455e5228d356cf78ddc79ec3f0a0ff5dd77f5cdaa6ba9508268eaf7ed135.exe
Size

146KB
MD5

82e6ceae0f6ef093e05b6ce49020e7a4
SHA1

344dee197461b500c59a32bb2c401b8f15e550b1
SHA256

eebd455e5228d356cf78ddc79ec3f0a0ff5dd77f5cdaa6ba9508268eaf7ed135
SHA512

a6e0b7abbd9593c1841b7aed2d3d313340313f3d7b91c5588bad9a5ef8a6dfb1021991f34ec4e829c02c4134930f78fca0aee9d2315aa06598c507c64e60a240
SSDEEP

3072:wPQt3aMxzd3o9fUPHC56IXsLkce6p23CskJXljt/wOl2RkJdoGTIcI:wPhaCEHpMGljt/RYkLBw

Score

8^/10

persistence

Malware Config

Signatures

Registers new Print Monitor 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	spoolsv.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\┼Σ╓├╨┼╧ó.txt	cmd.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spoolsv.exe

Kills process with taskkill 6 IoCs

evasion

pid	Process
3928	taskkill.exe
3168	taskkill.exe
3036	taskkill.exe
4220	taskkill.exe
212	taskkill.exe
2000	taskkill.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3036	taskkill.exe
Token: SeDebugPrivilege	4220	taskkill.exe
Token: SeDebugPrivilege	212	taskkill.exe
Token: SeDebugPrivilege	2000	taskkill.exe
Token: SeDebugPrivilege	3928	taskkill.exe
Token: SeDebugPrivilege	3168	taskkill.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2856	2132	eebd455e5228d356cf78ddc79ec3f0a0ff5dd77f5cdaa6ba9508268eaf7ed135.exe	83
PID 2132 wrote to memory of 2856	2132	eebd455e5228d356cf78ddc79ec3f0a0ff5dd77f5cdaa6ba9508268eaf7ed135.exe	83
PID 2132 wrote to memory of 2856	2132	eebd455e5228d356cf78ddc79ec3f0a0ff5dd77f5cdaa6ba9508268eaf7ed135.exe	83
PID 2856 wrote to memory of 3036	2856	cmd.exe	85
PID 2856 wrote to memory of 3036	2856	cmd.exe	85
PID 2856 wrote to memory of 3036	2856	cmd.exe	85
PID 2856 wrote to memory of 4220	2856	cmd.exe	86
PID 2856 wrote to memory of 4220	2856	cmd.exe	86
PID 2856 wrote to memory of 4220	2856	cmd.exe	86
PID 2856 wrote to memory of 212	2856	cmd.exe	87
PID 2856 wrote to memory of 212	2856	cmd.exe	87
PID 2856 wrote to memory of 212	2856	cmd.exe	87
PID 2856 wrote to memory of 2000	2856	cmd.exe	88
PID 2856 wrote to memory of 2000	2856	cmd.exe	88
PID 2856 wrote to memory of 2000	2856	cmd.exe	88
PID 2856 wrote to memory of 3928	2856	cmd.exe	89
PID 2856 wrote to memory of 3928	2856	cmd.exe	89
PID 2856 wrote to memory of 3928	2856	cmd.exe	89
PID 2856 wrote to memory of 3168	2856	cmd.exe	90
PID 2856 wrote to memory of 3168	2856	cmd.exe	90
PID 2856 wrote to memory of 3168	2856	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\eebd455e5228d356cf78ddc79ec3f0a0ff5dd77f5cdaa6ba9508268eaf7ed135.exe
"C:\Users\Admin\AppData\Local\Temp\eebd455e5228d356cf78ddc79ec3f0a0ff5dd77f5cdaa6ba9508268eaf7ed135.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Users\Admin\AppData\Local\Temp\bt3434.bat
  2⤵
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im ecplor*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rpstat.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4220
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im npver.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im setup.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im spoolsv.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im cmd.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3168

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Registers new Print Monitor
- Checks SCSI registry key(s)
PID:2320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bt3434.bat

Filesize
504B

MD5
b2ae7735031c2db845aee3231c28f607

SHA1
0fc7f68a282715546f45de37db2d27424c690db0

SHA256
4135696da8b0211576842a030b2682d5d8938ced79d07752756752fa90988830

SHA512
f904c214db324052b0248b74881e2079438a49d972eb4227a14d09de6b0989cedd1644f0cd230cd2b00d0bd1bee5191def4ba921158c87f10b7b95f02a88f4e6

Download Submit

Analysis

Sharing