130a06fb71d109922dbe5297c918c39132464b98644dbda97dfe9be35bba13a7

General

Target

ecebde9300d082exeexeexeex.exe
Size

327KB
MD5

ecebde9300d0826b2d19a1a4f2d71b36
SHA1

6398e9f01d13f7885f9821ed65ec9131b05bf194
SHA256

130a06fb71d109922dbe5297c918c39132464b98644dbda97dfe9be35bba13a7
SHA512

95ba9b3e2cdae18b5418fa4cdded30fcda6fe4257f2fb41a32bc67c92719e0874a0703700b35b9d06268ebac3ed3b5dca1769d9de2f2020ea360f1038b656798
SSDEEP

6144:T2+JS2sFafI8U0obHCW/2a7XQcsPMjVWrG8KgbPzDh:T2TFafJiHCWBWPMjVWrXK0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1164	dwmsys.exe
1660	dwmsys.exe

Loads dropped DLL 3 IoCs

pid	Process
556	ecebde9300d082exeexeexeex.exe
556	ecebde9300d082exeexeexeex.exe
556	ecebde9300d082exeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\DefaultIcon\ = "%1"	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\shell\open\command	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\shell\open\command\IsolatedCommand = "\"%1\" %*"	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\ = "Application"	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\DefaultIcon	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\shell\runas\command	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\dwmsys.exe\" /START \"%1\" %*"	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\ = "systemui"	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\DefaultIcon\ = "%1"	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open\command	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\shell	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\shell\open	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\DefaultIcon	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\shell\runas\command\ = "\"%1\" %*"	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas\command	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\Content-Type = "application/x-msdownload"	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\shell\runas	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	ecebde9300d082exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\shell\runas	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Posix\\dwmsys.exe\" /START \"%1\" %*"	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\systemui\shell\runas\command\IsolatedCommand = "\"%1\" %*"	ecebde9300d082exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	ecebde9300d082exeexeexeex.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1164	dwmsys.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 1164	556	ecebde9300d082exeexeexeex.exe	29
PID 556 wrote to memory of 1164	556	ecebde9300d082exeexeexeex.exe	29
PID 556 wrote to memory of 1164	556	ecebde9300d082exeexeexeex.exe	29
PID 556 wrote to memory of 1164	556	ecebde9300d082exeexeexeex.exe	29
PID 1164 wrote to memory of 1660	1164	dwmsys.exe	30
PID 1164 wrote to memory of 1660	1164	dwmsys.exe	30
PID 1164 wrote to memory of 1660	1164	dwmsys.exe	30
PID 1164 wrote to memory of 1660	1164	dwmsys.exe	30

C:\Users\Admin\AppData\Local\Temp\ecebde9300d082exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\ecebde9300d082exeexeexeex.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:556
- C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe"
    3⤵
    - Executes dropped EXE
    PID:1660

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe

Filesize
327KB

MD5
d01afe1b2169b60d01617e1cae6fba64

SHA1
ae7055bdb0e0302d6c9cabf3a2663e2c8a2a0997

SHA256
f8e01fc71ade8c0ccaa05b75ff21a660d43b590ac1d648ec7823def214576564

SHA512
083aca41b40caa25de7e260b17ae398d8462d439a5f34c5c30db7cf0d86122ce465b73453922a0745480a62cf5e54aa55fea91bddcab95825bad7d6489a46e6b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe

Filesize
327KB

MD5
d01afe1b2169b60d01617e1cae6fba64

SHA1
ae7055bdb0e0302d6c9cabf3a2663e2c8a2a0997

SHA256
f8e01fc71ade8c0ccaa05b75ff21a660d43b590ac1d648ec7823def214576564

SHA512
083aca41b40caa25de7e260b17ae398d8462d439a5f34c5c30db7cf0d86122ce465b73453922a0745480a62cf5e54aa55fea91bddcab95825bad7d6489a46e6b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe

Filesize
327KB

MD5
d01afe1b2169b60d01617e1cae6fba64

SHA1
ae7055bdb0e0302d6c9cabf3a2663e2c8a2a0997

SHA256
f8e01fc71ade8c0ccaa05b75ff21a660d43b590ac1d648ec7823def214576564

SHA512
083aca41b40caa25de7e260b17ae398d8462d439a5f34c5c30db7cf0d86122ce465b73453922a0745480a62cf5e54aa55fea91bddcab95825bad7d6489a46e6b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe

Filesize
327KB

MD5
d01afe1b2169b60d01617e1cae6fba64

SHA1
ae7055bdb0e0302d6c9cabf3a2663e2c8a2a0997

SHA256
f8e01fc71ade8c0ccaa05b75ff21a660d43b590ac1d648ec7823def214576564

SHA512
083aca41b40caa25de7e260b17ae398d8462d439a5f34c5c30db7cf0d86122ce465b73453922a0745480a62cf5e54aa55fea91bddcab95825bad7d6489a46e6b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe

Filesize
327KB

MD5
d01afe1b2169b60d01617e1cae6fba64

SHA1
ae7055bdb0e0302d6c9cabf3a2663e2c8a2a0997

SHA256
f8e01fc71ade8c0ccaa05b75ff21a660d43b590ac1d648ec7823def214576564

SHA512
083aca41b40caa25de7e260b17ae398d8462d439a5f34c5c30db7cf0d86122ce465b73453922a0745480a62cf5e54aa55fea91bddcab95825bad7d6489a46e6b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe

Filesize
327KB

MD5
d01afe1b2169b60d01617e1cae6fba64

SHA1
ae7055bdb0e0302d6c9cabf3a2663e2c8a2a0997

SHA256
f8e01fc71ade8c0ccaa05b75ff21a660d43b590ac1d648ec7823def214576564

SHA512
083aca41b40caa25de7e260b17ae398d8462d439a5f34c5c30db7cf0d86122ce465b73453922a0745480a62cf5e54aa55fea91bddcab95825bad7d6489a46e6b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Posix\dwmsys.exe

Filesize
327KB

MD5
d01afe1b2169b60d01617e1cae6fba64

SHA1
ae7055bdb0e0302d6c9cabf3a2663e2c8a2a0997

SHA256
f8e01fc71ade8c0ccaa05b75ff21a660d43b590ac1d648ec7823def214576564

SHA512
083aca41b40caa25de7e260b17ae398d8462d439a5f34c5c30db7cf0d86122ce465b73453922a0745480a62cf5e54aa55fea91bddcab95825bad7d6489a46e6b

Download Submit

Analysis

Sharing