4f792d5e32547cdbd6724cdf5fb4c6e4956c8f28fdc8be4a56f47b0964d393b1

General

Target

37616347c10d6f6623076e662b49f440.exe
Size

4.1MB
MD5

37616347c10d6f6623076e662b49f440
SHA1

b924cab04accb65219083b2d06a52bbb5db9c5fd
SHA256

4f792d5e32547cdbd6724cdf5fb4c6e4956c8f28fdc8be4a56f47b0964d393b1
SHA512

917f09979eda45b182a642d9422f4c02c1c41d9d887f8c45b3eeed53e3f97e450306455a4372d16fa537421f56f9f5c6435ad8830b84c3aa1fec2fce580f4256
SSDEEP

98304:1DMdmIG8JOPLIjwpbW+xPsFlguFWe5+Vvdo/Wj13Zu:1QFG8JoLIjArMs+Ot

Score

7^/10

persistence

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 6 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell\ASM Guard\ = "Protect in ASM Guard"	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell\ASM Guard\Icon = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37616347c10d6f6623076e662b49f440.exe"	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell\ASM Guard\command	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell\ASM Guard\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\37616347c10d6f6623076e662b49f440.exe\" \"%1\""	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell\ASM Guard	37616347c10d6f6623076e662b49f440.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3436	37616347c10d6f6623076e662b49f440.exe
3436	37616347c10d6f6623076e662b49f440.exe

Modifies registry class 26 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\dllfile\shell\ASM Guard\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\37616347c10d6f6623076e662b49f440.exe\" \"%1\""	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\.asmg	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\ASM_Guard\DefaultIcon	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\ASM_Guard\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\37616347c10d6f6623076e662b49f440.exe\" \"%1\""	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\dllfile\shell	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\ASM_Guard	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\dllfile\shell\ASM Guard\Icon = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37616347c10d6f6623076e662b49f440.exe"	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell\ASM Guard	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell\ASM Guard\ = "Protect in ASM Guard"	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\ASM_Guard\shell\open\ = "Open"	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\dllfile\shell\ASM Guard\ = "Protect in ASM Guard"	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\dllfile	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\dllfile\shell\ASM Guard	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell\ASM Guard\Icon = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37616347c10d6f6623076e662b49f440.exe"	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\.asmg\ = "ASM_Guard"	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\ASM_Guard\ = "ASM Guard project"	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\ASM_Guard\shell\open\command	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell\ASM Guard\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\37616347c10d6f6623076e662b49f440.exe\" \"%1\""	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\ASM_Guard\shell\open	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\dllfile\shell\ASM Guard\command	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\ASM_Guard\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37616347c10d6f6623076e662b49f440.exe"	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\ASM_Guard\shell	37616347c10d6f6623076e662b49f440.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\ASM_Guard\shell\ = "open"	37616347c10d6f6623076e662b49f440.exe
Key created	\REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000_Classes\exefile\shell\ASM Guard\command	37616347c10d6f6623076e662b49f440.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3436	37616347c10d6f6623076e662b49f440.exe

C:\Users\Admin\AppData\Local\Temp\37616347c10d6f6623076e662b49f440.exe
"C:\Users\Admin\AppData\Local\Temp\37616347c10d6f6623076e662b49f440.exe"
1⤵
- Modifies system executable filetype association
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

1

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3436-0-0x00000217F2680000-0x00000217F2CD2000-memory.dmp

Filesize
6.3MB

Download
memory/3436-1-0x00007FFDCB3C0000-0x00007FFDCBE81000-memory.dmp

Filesize
10.8MB

Download
memory/3436-2-0x00000217F4830000-0x00000217F4831000-memory.dmp

Filesize
4KB

Download
memory/3436-3-0x00000217F5120000-0x00000217F5130000-memory.dmp

Filesize
64KB

Download
memory/3436-4-0x00000217F4980000-0x00000217F498A000-memory.dmp

Filesize
40KB

Download
memory/3436-5-0x00000217F50E0000-0x00000217F50F2000-memory.dmp

Filesize
72KB

Download
memory/3436-6-0x00000217F5120000-0x00000217F5130000-memory.dmp

Filesize
64KB

Download
memory/3436-7-0x00000217F5120000-0x00000217F5130000-memory.dmp

Filesize
64KB

Download
memory/3436-8-0x00000217F5120000-0x00000217F5130000-memory.dmp

Filesize
64KB

Download
memory/3436-9-0x00007FFDCB3C0000-0x00007FFDCBE81000-memory.dmp

Filesize
10.8MB

Download
memory/3436-10-0x00000217F5120000-0x00000217F5130000-memory.dmp

Filesize
64KB

Download
memory/3436-11-0x00000217F5120000-0x00000217F5130000-memory.dmp

Filesize
64KB

Download
memory/3436-12-0x00000217F87A0000-0x00000217F88A2000-memory.dmp

Filesize
1.0MB

Download
memory/3436-13-0x00000217F5120000-0x00000217F5130000-memory.dmp

Filesize
64KB

Download
memory/3436-14-0x00000217F5120000-0x00000217F5130000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads