4580b172af2daef110ed5ae23849ff3a43f8a704c5ddb75f7f5739f45ba83cfe

General

Target

b9eae9250c31acexeexeexeex.exe
Size

288KB
MD5

b9eae9250c31acb967c38beefa3e61a0
SHA1

cf274797fc25243cc2eb67b375847a7710f18027
SHA256

4580b172af2daef110ed5ae23849ff3a43f8a704c5ddb75f7f5739f45ba83cfe
SHA512

5a1fc87bc1792aee844c0c77261b99e58006f0450e258fbff65aba2a11ea56d1078a7fbaccb0487de1a41e506a3409ec1fcb06ad4c154907b88973ae49554f53
SSDEEP

6144:OQ+Tyfx4NF67Sbq2nW82X45gc3BaLZVS0mOoC8zbzDie:OQMyfmNFHfnWfhLZVHmOog

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3044	winit32.exe
2192	winit32.exe

Loads dropped DLL 3 IoCs

pid	Process
1352	b9eae9250c31acexeexeexeex.exe
1352	b9eae9250c31acexeexeexeex.exe
1352	b9eae9250c31acexeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\runas\command	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\DefaultIcon\ = "%1"	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\DefaultIcon	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\DefaultIcon\ = "%1"	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas\command	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\ = "Application"	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\ = "haldriver"	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\open\command	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\runas	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\open	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\winit32.exe\" /START \"%1\" %*"	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\runas\command\ = "\"%1\" %*"	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\DefaultIcon	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\haldriver\Content-Type = "application/x-msdownload"	b9eae9250c31acexeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open\command	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\winit32.exe\" /START \"%1\" %*"	b9eae9250c31acexeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	b9eae9250c31acexeexeexeex.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3044	winit32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 3044	1352	b9eae9250c31acexeexeexeex.exe	29
PID 1352 wrote to memory of 3044	1352	b9eae9250c31acexeexeexeex.exe	29
PID 1352 wrote to memory of 3044	1352	b9eae9250c31acexeexeexeex.exe	29
PID 1352 wrote to memory of 3044	1352	b9eae9250c31acexeexeexeex.exe	29
PID 3044 wrote to memory of 2192	3044	winit32.exe	30
PID 3044 wrote to memory of 2192	3044	winit32.exe	30
PID 3044 wrote to memory of 2192	3044	winit32.exe	30
PID 3044 wrote to memory of 2192	3044	winit32.exe	30

C:\Users\Admin\AppData\Local\Temp\b9eae9250c31acexeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\b9eae9250c31acexeexeexeex.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe"
    3⤵
    - Executes dropped EXE
    PID:2192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
288KB

MD5
448919024dbf74040f0e423dd9f8f45a

SHA1
79b52bdaf35aef7989479da5a6ec9b8b476b6660

SHA256
6577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b

SHA512
0a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
288KB

MD5
448919024dbf74040f0e423dd9f8f45a

SHA1
79b52bdaf35aef7989479da5a6ec9b8b476b6660

SHA256
6577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b

SHA512
0a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
288KB

MD5
448919024dbf74040f0e423dd9f8f45a

SHA1
79b52bdaf35aef7989479da5a6ec9b8b476b6660

SHA256
6577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b

SHA512
0a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
288KB

MD5
448919024dbf74040f0e423dd9f8f45a

SHA1
79b52bdaf35aef7989479da5a6ec9b8b476b6660

SHA256
6577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b

SHA512
0a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
288KB

MD5
448919024dbf74040f0e423dd9f8f45a

SHA1
79b52bdaf35aef7989479da5a6ec9b8b476b6660

SHA256
6577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b

SHA512
0a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
288KB

MD5
448919024dbf74040f0e423dd9f8f45a

SHA1
79b52bdaf35aef7989479da5a6ec9b8b476b6660

SHA256
6577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b

SHA512
0a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\winit32.exe

Filesize
288KB

MD5
448919024dbf74040f0e423dd9f8f45a

SHA1
79b52bdaf35aef7989479da5a6ec9b8b476b6660

SHA256
6577ba614fe627ce0ac672f03d90e2d982d7768722afb31c273aab470978287b

SHA512
0a2303f4251c0816a65b794ced4a81e32b13b1e182605052b7a019a94d60bdf038d127602d79f1393a0b0c6878d45eeae2b1796e84b5b96d980e36c88164844b

Download Submit

Analysis

Sharing