723e9848231a01412bfdef39d912c841f832f29cfaab6019e01f7d4e64ef01b0

General

Target

Payload.exe
Size

27KB
MD5

76860b5759bcbe6665e98564bb213b0b
SHA1

b18d7df7cc5b82cc6a5de93a1fcab2bba488e009
SHA256

723e9848231a01412bfdef39d912c841f832f29cfaab6019e01f7d4e64ef01b0
SHA512

9d8c0768c6ab4d2adea7b2d264a357403cc8e8455fd65b7c52ccd5c78a2787932c2f511729cd4f7c41c768efb5a5420080d5d6b39a9308599b48575bc9dd210e
SSDEEP

384:2LoFhQf3GownyfwNUlBUAC2PnthlMxAQk93vmhm7UMKmIEecKdbXTzm9bVhcaH6b:wY2u8oy+xA/vMHTi9bD

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 3 IoCs

Processes:

Payload.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Payload.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Payload.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Payload.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-177160434-2093019976-369403398-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\Windows.URL"	Payload.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Payload.exe

pid process

4048 Payload.exe

pid	process
4048	Payload.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Payload.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: SeManageVolumePrivilege	2636	svchost.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe
Token: 33	4048	Payload.exe
Token: SeIncBasePriorityPrivilege	4048	Payload.exe

C:\Users\Admin\AppData\Local\Temp\Payload.exe
"C:\Users\Admin\AppData\Local\Temp\Payload.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4048

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2636

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2636-52-0x000002587FB60000-0x000002587FB61000-memory.dmp

Filesize
4KB

Download
memory/2636-84-0x000002587F8F0000-0x000002587F8F1000-memory.dmp

Filesize
4KB

Download
memory/2636-89-0x000002587F8F0000-0x000002587F8F1000-memory.dmp

Filesize
4KB

Download
memory/2636-87-0x000002587F8F0000-0x000002587F8F1000-memory.dmp

Filesize
4KB

Download
memory/2636-86-0x000002587F8F0000-0x000002587F8F1000-memory.dmp

Filesize
4KB

Download
memory/2636-85-0x000002587F8F0000-0x000002587F8F1000-memory.dmp

Filesize
4KB

Download
memory/2636-10-0x000002587F460000-0x000002587F470000-memory.dmp

Filesize
64KB

Download
memory/2636-26-0x000002587F560000-0x000002587F570000-memory.dmp

Filesize
64KB

Download
memory/2636-42-0x000002587FB50000-0x000002587FB51000-memory.dmp

Filesize
4KB

Download
memory/2636-43-0x000002587FB50000-0x000002587FB51000-memory.dmp

Filesize
4KB

Download
memory/2636-44-0x000002587FB50000-0x000002587FB51000-memory.dmp

Filesize
4KB

Download
memory/2636-45-0x000002587FB50000-0x000002587FB51000-memory.dmp

Filesize
4KB

Download
memory/2636-46-0x000002587FB50000-0x000002587FB51000-memory.dmp

Filesize
4KB

Download
memory/2636-54-0x000002587F790000-0x000002587F791000-memory.dmp

Filesize
4KB

Download
memory/2636-48-0x000002587FB50000-0x000002587FB51000-memory.dmp

Filesize
4KB

Download
memory/2636-49-0x000002587FB50000-0x000002587FB51000-memory.dmp

Filesize
4KB

Download
memory/2636-50-0x000002587FB60000-0x000002587FB61000-memory.dmp

Filesize
4KB

Download
memory/2636-51-0x000002587FB60000-0x000002587FB61000-memory.dmp

Filesize
4KB

Download
memory/2636-88-0x000002587F8F0000-0x000002587F8F1000-memory.dmp

Filesize
4KB

Download
memory/2636-53-0x000002587F7A0000-0x000002587F7A1000-memory.dmp

Filesize
4KB

Download
memory/2636-47-0x000002587FB50000-0x000002587FB51000-memory.dmp

Filesize
4KB

Download
memory/2636-56-0x000002587F7A0000-0x000002587F7A1000-memory.dmp

Filesize
4KB

Download
memory/2636-59-0x000002587F790000-0x000002587F791000-memory.dmp

Filesize
4KB

Download
memory/2636-62-0x000002587F6D0000-0x000002587F6D1000-memory.dmp

Filesize
4KB

Download
memory/2636-74-0x000002587F8D0000-0x000002587F8D1000-memory.dmp

Filesize
4KB

Download
memory/2636-76-0x000002587F8E0000-0x000002587F8E1000-memory.dmp

Filesize
4KB

Download
memory/2636-77-0x000002587F8E0000-0x000002587F8E1000-memory.dmp

Filesize
4KB

Download
memory/2636-78-0x000002587F9F0000-0x000002587F9F1000-memory.dmp

Filesize
4KB

Download
memory/2636-79-0x000002587F8F0000-0x000002587F8F1000-memory.dmp

Filesize
4KB

Download
memory/2636-80-0x000002587F8F0000-0x000002587F8F1000-memory.dmp

Filesize
4KB

Download
memory/2636-81-0x000002587F8F0000-0x000002587F8F1000-memory.dmp

Filesize
4KB

Download
memory/2636-82-0x000002587F8F0000-0x000002587F8F1000-memory.dmp

Filesize
4KB

Download
memory/2636-83-0x000002587F8F0000-0x000002587F8F1000-memory.dmp

Filesize
4KB

Download
memory/4048-2-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Filesize
64KB

Download
memory/4048-9-0x0000000000FA0000-0x0000000000FB0000-memory.dmp

Filesize
64KB

Download
memory/4048-8-0x00000000745D0000-0x0000000074B81000-memory.dmp

Filesize
5.7MB

Download
memory/4048-7-0x00000000745D0000-0x0000000074B81000-memory.dmp

Filesize
5.7MB

Download
memory/4048-0-0x00000000745D0000-0x0000000074B81000-memory.dmp

Filesize
5.7MB

Download
memory/4048-1-0x00000000745D0000-0x0000000074B81000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads