8e06b3ea4555f3ebbf34cd4b63a0d66830a4f63c5bcec4009e2bb9a62501145e

General

Target

8a8620c75869efexeexeexeex.exe
Size

288KB
MD5

8a8620c75869efc428a0107a3cbf4bb8
SHA1

903f0ededf3ac451e15fbf963d98c6a79dac5955
SHA256

8e06b3ea4555f3ebbf34cd4b63a0d66830a4f63c5bcec4009e2bb9a62501145e
SHA512

eafb21dbb4f9b2c42737b2d58bbe71c943564309c0f7f78e26e92488d854c1f9a487e7aa69821a7095df13d552dd2fd7b41ba2f2f48b8d9fd617cdff465bf014
SSDEEP

6144:5Q+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:5QMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3056	SearchIndexerDB.exe
2908	SearchIndexerDB.exe

Loads dropped DLL 3 IoCs

pid	Process
2276	8a8620c75869efexeexeexeex.exe
2276	8a8620c75869efexeexeexeex.exe
2276	8a8620c75869efexeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\shell\open\command	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\DefaultIcon\ = "%1"	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\SearchIndexerDB.exe\" /START \"%1\" %*"	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\ = "cmos"	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\Content-Type = "application/x-msdownload"	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\shell\runas\command	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\shell\runas\command\ = "\"%1\" %*"	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\runas	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\ = "Application"	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\runas\command	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\shell\runas\command\IsolatedCommand = "\"%1\" %*"	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\open\command	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\open	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\shell\open	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\SearchIndexerDB.exe\" /START \"%1\" %*"	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\DefaultIcon	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\DefaultIcon\ = "%1"	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\shell	8a8620c75869efexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\shell\open\command\IsolatedCommand = "\"%1\" %*"	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\cmos\shell\runas	8a8620c75869efexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\.exe\DefaultIcon	8a8620c75869efexeexeexeex.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3056	SearchIndexerDB.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2276 wrote to memory of 3056	2276	8a8620c75869efexeexeexeex.exe	27
PID 2276 wrote to memory of 3056	2276	8a8620c75869efexeexeexeex.exe	27
PID 2276 wrote to memory of 3056	2276	8a8620c75869efexeexeexeex.exe	27
PID 2276 wrote to memory of 3056	2276	8a8620c75869efexeexeexeex.exe	27
PID 3056 wrote to memory of 2908	3056	SearchIndexerDB.exe	28
PID 3056 wrote to memory of 2908	3056	SearchIndexerDB.exe	28
PID 3056 wrote to memory of 2908	3056	SearchIndexerDB.exe	28
PID 3056 wrote to memory of 2908	3056	SearchIndexerDB.exe	28

C:\Users\Admin\AppData\Local\Temp\8a8620c75869efexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\8a8620c75869efexeexeexeex.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2276
- C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe"
    3⤵
    - Executes dropped EXE
    PID:2908

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe

Filesize
288KB

MD5
f40a70b96c3f03138998d58c3012566a

SHA1
aa30cd9b1b8602e96e7fd033e4e00f54a1b6fc1a

SHA256
f2bdb91c60f6288f7f18326fa7074c6283ff27b0ebacb33d05362a70d6302fec

SHA512
8463f4520d28d8dc6642e130256207e8c1197fea7f306d811fcae45faeff76dc5d368193170cd607d20835c7305be440084d11860020b852b571b2fce9425daf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe

Filesize
288KB

MD5
f40a70b96c3f03138998d58c3012566a

SHA1
aa30cd9b1b8602e96e7fd033e4e00f54a1b6fc1a

SHA256
f2bdb91c60f6288f7f18326fa7074c6283ff27b0ebacb33d05362a70d6302fec

SHA512
8463f4520d28d8dc6642e130256207e8c1197fea7f306d811fcae45faeff76dc5d368193170cd607d20835c7305be440084d11860020b852b571b2fce9425daf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe

Filesize
288KB

MD5
f40a70b96c3f03138998d58c3012566a

SHA1
aa30cd9b1b8602e96e7fd033e4e00f54a1b6fc1a

SHA256
f2bdb91c60f6288f7f18326fa7074c6283ff27b0ebacb33d05362a70d6302fec

SHA512
8463f4520d28d8dc6642e130256207e8c1197fea7f306d811fcae45faeff76dc5d368193170cd607d20835c7305be440084d11860020b852b571b2fce9425daf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe

Filesize
288KB

MD5
f40a70b96c3f03138998d58c3012566a

SHA1
aa30cd9b1b8602e96e7fd033e4e00f54a1b6fc1a

SHA256
f2bdb91c60f6288f7f18326fa7074c6283ff27b0ebacb33d05362a70d6302fec

SHA512
8463f4520d28d8dc6642e130256207e8c1197fea7f306d811fcae45faeff76dc5d368193170cd607d20835c7305be440084d11860020b852b571b2fce9425daf

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe

Filesize
288KB

MD5
f40a70b96c3f03138998d58c3012566a

SHA1
aa30cd9b1b8602e96e7fd033e4e00f54a1b6fc1a

SHA256
f2bdb91c60f6288f7f18326fa7074c6283ff27b0ebacb33d05362a70d6302fec

SHA512
8463f4520d28d8dc6642e130256207e8c1197fea7f306d811fcae45faeff76dc5d368193170cd607d20835c7305be440084d11860020b852b571b2fce9425daf

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe

Filesize
288KB

MD5
f40a70b96c3f03138998d58c3012566a

SHA1
aa30cd9b1b8602e96e7fd033e4e00f54a1b6fc1a

SHA256
f2bdb91c60f6288f7f18326fa7074c6283ff27b0ebacb33d05362a70d6302fec

SHA512
8463f4520d28d8dc6642e130256207e8c1197fea7f306d811fcae45faeff76dc5d368193170cd607d20835c7305be440084d11860020b852b571b2fce9425daf

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\SearchIndexerDB.exe

Filesize
288KB

MD5
f40a70b96c3f03138998d58c3012566a

SHA1
aa30cd9b1b8602e96e7fd033e4e00f54a1b6fc1a

SHA256
f2bdb91c60f6288f7f18326fa7074c6283ff27b0ebacb33d05362a70d6302fec

SHA512
8463f4520d28d8dc6642e130256207e8c1197fea7f306d811fcae45faeff76dc5d368193170cd607d20835c7305be440084d11860020b852b571b2fce9425daf

Download Submit

Analysis

Sharing