12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b

General

Target

12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
Size

2.0MB
MD5

297d2f29b5dad1fe8c1501dc8bcf6599
SHA1

abb173c69098d6a25052044cf36c82b288870abc
SHA256

12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b
SHA512

64a8ec508af6574bde722629203c4145c747b593cb98a6e518ee437510cc2f8c4439558b6d812f535a0706dce933ed8b21f39d111374aff184eb39ddcfb05c50
SSDEEP

24576:C/zOjoFNSkR1DVTS+QR/896xUDcvBwkpr+u+7l22V1C+9hOFdP+n02/SCEOEag54:rjYNLVTTwTxUDKBu7lb1tYeQOKO

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4588	attrib.exe
1052	attrib.exe

Executes dropped EXE 1 IoCs

pid	Process
3244	backgroundTaskHost.dll

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft IME = "C:\\Windows\\regedlt.exe"	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\backgroundTaskHost.dll	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
File opened for modification	C:\Windows\backgroundTaskHost.dll	attrib.exe
File opened for modification	C:\Windows\regedlt.exe	attrib.exe
File created	C:\Windows\regedlt.exe	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
3244	backgroundTaskHost.dll
3244	backgroundTaskHost.dll

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 1824	216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe	86
PID 216 wrote to memory of 1824	216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe	86
PID 216 wrote to memory of 1824	216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe	86
PID 216 wrote to memory of 4736	216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe	88
PID 216 wrote to memory of 4736	216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe	88
PID 216 wrote to memory of 4736	216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe	88
PID 216 wrote to memory of 3244	216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe	90
PID 216 wrote to memory of 3244	216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe	90
PID 216 wrote to memory of 3244	216	12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe	90
PID 4736 wrote to memory of 1052	4736	cmd.exe	92
PID 4736 wrote to memory of 1052	4736	cmd.exe	92
PID 4736 wrote to memory of 1052	4736	cmd.exe	92
PID 1824 wrote to memory of 4588	1824	cmd.exe	91
PID 1824 wrote to memory of 4588	1824	cmd.exe	91
PID 1824 wrote to memory of 4588	1824	cmd.exe	91

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4588	attrib.exe
1052	attrib.exe

C:\Users\Admin\AppData\Local\Temp\12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe
"C:\Users\Admin\AppData\Local\Temp\12b6b31717aa1fdccbacdc92aa92d9e6ab638f1e69bc33eb60e83f7ad5e6ac1b.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c attrib +s +h C:\Windows\regedlt.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h C:\Windows\regedlt.exe
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c attrib +s +h C:\Windows\backgroundTaskHost.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4736
- - C:\Windows\SysWOW64\attrib.exe
    attrib +s +h C:\Windows\backgroundTaskHost.dll
    3⤵
    - Sets file to hidden
    - Drops file in Windows directory
    - Views/modifies file attributes
    PID:1052
- C:\Windows\backgroundTaskHost.dll
  C:\Windows\backgroundTaskHost.dll
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

3

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\backgroundTaskHost.dll

Filesize
1.1MB

MD5
239367030218a80df0c3e10998e41944

SHA1
3434c6b6b76fce8b32a22e3d2333360bbf5cf263

SHA256
0470d2bb3b9704431e67042a8e364691867c0746c087d46d7cf3a30c8705c364

SHA512
a2df0df9c0674078c7f8a90216b41f2c4821b16ca117740dbe5fd9af30699491bfba3555d52cb3ddfce1567028602b02853e6a9812a2bc33cb49cb38acbe9b77

Download Submit
C:\Windows\backgroundTaskHost.dll

Filesize
1.1MB

MD5
239367030218a80df0c3e10998e41944

SHA1
3434c6b6b76fce8b32a22e3d2333360bbf5cf263

SHA256
0470d2bb3b9704431e67042a8e364691867c0746c087d46d7cf3a30c8705c364

SHA512
a2df0df9c0674078c7f8a90216b41f2c4821b16ca117740dbe5fd9af30699491bfba3555d52cb3ddfce1567028602b02853e6a9812a2bc33cb49cb38acbe9b77

Download Submit
C:\Windows\regedlt.exe

Filesize
688KB

MD5
fb09a3b0530221f7ea21b2c74d45a1e6

SHA1
ead0460a76ace5726e6866c9007b0e663c69fb4f

SHA256
aa600469d84388f68bb3aae8354825f1b26cd78f11eb741e526d7f75950fd452

SHA512
49de224bd195ec855a1b49938ad395c77a3ae22c23388e9c44ba0181b79bcbbfb93fe23dd16ae64b321bf43dc4e1f78c901af5d9bbe6583a50db26778c6f0bf8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads