ce7e4f57d738e91311d0dd3a8b8d8dcb1374ee9ae7da57d14a47e1d2432a5b3f

Analysis

max time kernel
129s
max time network
136s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
14-12-2023 07:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce7e4f57d738e91311d0dd3a8b8d8dcb1374ee9ae7da57d14a47e1d2432a5b3f.exe
Size

1.9MB
MD5

a60a60af95a32a81795761865b7f3bd9
SHA1

6573299b94c46cebfaec0b25f85e921b7b3a7cbc
SHA256

ce7e4f57d738e91311d0dd3a8b8d8dcb1374ee9ae7da57d14a47e1d2432a5b3f
SHA512

113205d19a41a82a62ca84197ddf6cf62d798af3e0dcc5f56423da213b79a443154fa683bce2f22b794357ea62f3b83ba217effa4e22af81cdf890fecc49415f
SSDEEP

49152:NjPTJMkPEn2W/W/WI+fiUBHskWLEMPtckTgNbC:NDTJPEl/lI+fiieTtjsbC

Score

8^/10

evasion persistence upx

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Drops file in Drivers directory 4 IoCs

Processes:

cmd.execmd.exe

description	ioc	process
File created	C:\Windows\System32\drivers\hrwfpdrv.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\hrwfpdrv.sys	cmd.exe
File created	C:\Windows\System32\drivers\sysdiag.sys	cmd.exe
File opened for modification	C:\Windows\System32\drivers\sysdiag.sys	cmd.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\hrwfpdr\ImagePath = "system32\\DRIVERS\\hrwfpdrv.sys"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\sysdiag\ImagePath = "system32\\DRIVERS\\sysdiag.sys"	reg.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489
Executes dropped EXE 1 IoCs

Processes:

HRSword.exe

pid process

5100 HRSword.exe
Loads dropped DLL 6 IoCs

Processes:

HRSword.exe

pid process

5100 HRSword.exe
5100 HRSword.exe
5100 HRSword.exe
5100 HRSword.exe
5100 HRSword.exe
5100 HRSword.exe

pid	process
5100	HRSword.exe

pid	process
5100	HRSword.exe
5100	HRSword.exe
5100	HRSword.exe
5100	HRSword.exe
5100	HRSword.exe
5100	HRSword.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/4884-0-0x0000000000400000-0x000000000042D000-memory.dmp	upx
behavioral1/memory/4884-59-0x0000000000400000-0x000000000042D000-memory.dmp	upx

Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exesc.exe

pid process

1440 sc.exe
5060 sc.exe
2180 sc.exe
4640 sc.exe
4632 sc.exe
2992 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

pid process

608
608
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

HRSword.exe

description pid process

Token: SeDebugPrivilege 5100 HRSword.exe

pid	process
1440	sc.exe
5060	sc.exe
2180	sc.exe
4640	sc.exe
4632	sc.exe
2992	sc.exe

pid	process
608
608

description	pid	process
Token: SeDebugPrivilege	5100	HRSword.exe

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

ce7e4f57d738e91311d0dd3a8b8d8dcb1374ee9ae7da57d14a47e1d2432a5b3f.execmd.exenet.exenet.exe

description	pid	process	target process
PID 4884 wrote to memory of 2600	4884	ce7e4f57d738e91311d0dd3a8b8d8dcb1374ee9ae7da57d14a47e1d2432a5b3f.exe	cmd.exe
PID 4884 wrote to memory of 2600	4884	ce7e4f57d738e91311d0dd3a8b8d8dcb1374ee9ae7da57d14a47e1d2432a5b3f.exe	cmd.exe
PID 2600 wrote to memory of 4888	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 4888	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 4224	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 4224	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 5084	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 5084	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 1244	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 1244	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 2608	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 2608	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 5004	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 5004	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 1248	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 1248	2600	cmd.exe	cmd.exe
PID 2600 wrote to memory of 2180	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 2180	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 4640	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 4640	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 4992	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 4992	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 792	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 792	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 4724	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 4724	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 1640	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 1640	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 916	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 916	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 3484	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 3484	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 4068	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 4068	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 3500	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 3500	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 4632	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 4632	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 2992	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 2992	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 5100	2600	cmd.exe	HRSword.exe
PID 2600 wrote to memory of 5100	2600	cmd.exe	HRSword.exe
PID 2600 wrote to memory of 5100	2600	cmd.exe	HRSword.exe
PID 2600 wrote to memory of 2352	2600	cmd.exe	net.exe
PID 2600 wrote to memory of 2352	2600	cmd.exe	net.exe
PID 2352 wrote to memory of 4472	2352	net.exe	net1.exe
PID 2352 wrote to memory of 4472	2352	net.exe	net1.exe
PID 2600 wrote to memory of 4968	2600	cmd.exe	net.exe
PID 2600 wrote to memory of 4968	2600	cmd.exe	net.exe
PID 4968 wrote to memory of 3492	4968	net.exe	net1.exe
PID 4968 wrote to memory of 3492	4968	net.exe	net1.exe
PID 2600 wrote to memory of 1440	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 1440	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 5060	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 5060	2600	cmd.exe	sc.exe
PID 2600 wrote to memory of 4560	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 4560	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 3144	2600	cmd.exe	reg.exe
PID 2600 wrote to memory of 3144	2600	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\ce7e4f57d738e91311d0dd3a8b8d8dcb1374ee9ae7da57d14a47e1d2432a5b3f.exe
"C:\Users\Admin\AppData\Local\Temp\ce7e4f57d738e91311d0dd3a8b8d8dcb1374ee9ae7da57d14a47e1d2432a5b3f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @pushd "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000" >nul 2>&1 & CALL "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\HRSword.bat"
2⤵
- Suspicious use of WriteProcessMemory
PID:2600

C:\Windows\system32\reg.exe
REG QUERY "HKU\S-1-5-19"
3⤵
PID:4888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:4224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" copy Drivers\x64\usysdiag.exe "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\\" 1>NUL 2>NUL"
3⤵
PID:5084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:1244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" copy Drivers\x64\sysdiag.sys "C:\Windows\System32\drivers\" 1>NUL 2>NUL"
3⤵
- Drops file in Drivers directory
PID:2608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo y"
3⤵
PID:5004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" copy Drivers\x64\hrwfpdrv.sys "C:\Windows\System32\drivers\" 1>NUL 2>NUL"
3⤵
- Drops file in Drivers directory
PID:1248

C:\Windows\system32\sc.exe
sc create hrwfpdrv binpath= "C:\Windows\System32\drivers\hrwfpdrv.sys" type= kernel start= demand error= normal
3⤵
- Launches sc.exe
PID:2180

C:\Windows\system32\sc.exe
sc create sysdiag binpath= "C:\Windows\System32\drivers\sysdiag.sys" type= kernel start= demand error= normal depend= FltMgr group= "PNP_TDI"
3⤵
- Launches sc.exe
PID:4640

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag" /f /v "ImagePath" /t REG_EXPAND_SZ /d "system32\DRIVERS\sysdiag.sys"
3⤵
- Sets service image path in registry
PID:4992

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\hrwfpdr" /f /v "ImagePath" /t REG_EXPAND_SZ /d "system32\DRIVERS\hrwfpdrv.sys"
3⤵
- Sets service image path in registry
PID:792

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag" /f /v "Start" /t reg_dword /d "1"
3⤵
PID:4724

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\hrwfpdr" /f /v "Start" /t reg_dword /d "1"
3⤵
PID:1640

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag" /f /v "Group" /d "PNP_TDI"
3⤵
PID:916

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag\Instances" /f /v "DefaultInstance" /d "sysdiag"
3⤵
PID:3484

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag\Instances\sysdiag" /f /v "Altitude" /d "324600"
3⤵
PID:4068

C:\Windows\system32\reg.exe
reg add "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag\Instances\sysdiag" /f /v "Flags" /t reg_dword /d "0"
3⤵
PID:3500

C:\Windows\system32\sc.exe
sc start sysdiag
3⤵
- Launches sc.exe
PID:4632

C:\Windows\system32\sc.exe
sc start hrwfpdrv
3⤵
- Launches sc.exe
PID:2992

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\HRSword.exe
HRSword.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5100

C:\Windows\system32\net.exe
net stop "sysdiag"
3⤵
- Suspicious use of WriteProcessMemory
PID:2352

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "sysdiag"
4⤵
PID:4472

C:\Windows\system32\net.exe
net stop "hrwfpdrv"
3⤵
- Suspicious use of WriteProcessMemory
PID:4968

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "hrwfpdrv"
4⤵
PID:3492

C:\Windows\system32\sc.exe
sc delete "hrwfpdrv"
3⤵
- Launches sc.exe
PID:1440

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\hrwfpdr" /f
3⤵
PID:4560

C:\Windows\system32\sc.exe
sc delete "sysdiag"
3⤵
- Launches sc.exe
PID:5060

C:\Windows\system32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\sysdiag" /f
3⤵
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Drivers\x64\hrwfpdrv.sys

Filesize
122KB

MD5
3d6b41a929f4e43dd314d1faacfeaa07

SHA1
8567f8a7ab86771d321ed987acabd500c45983d5

SHA256
01a3dabb4684908082cb2ac710d5d42afae2d30f282f023d54d7e945ad3272f5

SHA512
475ba01e59425b3c5f36b3d2ce4e7779d5ba9b7a958c831f080641bf6d61928dffda219c234201733a671d868b462c55dbf1a5cb9acfee39e4f2af9e7c359393

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Drivers\x64\sysdiag.sys

Filesize
372KB

MD5
24f25d123103e16a33e3820e9caeb221

SHA1
4ab5f84dc23f3e57c5085952c177d27133de8934

SHA256
11b262c936ffa8eb83457efd3261578376d49d6e789c7c026f1fa0b91929e135

SHA512
468d7ce08f1f7e6f8accbf34387b2852c677db77825be2984e8ae3c19c40cd77538d40f37a85aa83e59677cdc894d3d13e82d2fe054f6c61faa7dc46dd462f60

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Drivers\x64\usysdiag.exe

Filesize
465KB

MD5
033c9f28acadaaa32d947a4026020bea

SHA1
48c62ced29bfbdf25b60c692c9b2b9396c895ee3

SHA256
90040340ee101cac7831d7035230ac8ad4224d432e5636f34f13aa1c4a0c2041

SHA512
a2fc74c738450cb7daeefa88bd0e875304e7a05a9b2ec6a918a32618044ed32ace94be3840aa4b615a3322621e43dfe135659309f85092471dbc4b5e71a2f315

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\HRSword.bat

Filesize
2KB

MD5
08287d592dbb0b62b6102ba69c41cd01

SHA1
2ad8841b3f08f7769fa01bb444a6c940cf0b850d

SHA256
edeacb1eb572585b590291670cd94e91ebbf5b4b1e8e33d7df6d118abf5da654

SHA512
38b7b6f5545190b3c53ec40857dd51d17ed811813c777a134bf8a9c61eafa6cfe14b3c2102de9e84cf144dcdb331316c5775954a8637f0558b6d20d8a83d3294

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\HRSword.exe

Filesize
1.2MB

MD5
f3f6a3ad37c08d53db9fd94827b24b28

SHA1
ea57fd1d4ea8a3bbee6dc8f3bc8b4ac230a85fe3

SHA256
5d44528171262b48899c3c1887f79d4eafa5491d6ad32d4e4db241c54d00bcb5

SHA512
b7d1e8ae551d19289c838739cdeef236f696697274937fb35d118ea1c78fc0696a2b75441641e5e4ab707bb20393d408f55ceb9ea2d33aa7adf54a53dc1f315d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\HRSword.exe

Filesize
1.5MB

MD5
322e0770b0125261d5366ee6fe6a24cd

SHA1
14d3b9d9f3bf9514fa7e08d72e302c0c57cbc1c3

SHA256
a4dcc657bed118b4459115522477abc5364cc099f23db93f6a6d3088cfb66051

SHA512
dfd553d68cf23848673812b2da879315404ef8db2d69add8061f7e5cbf93a069e93484e78b642c10c52f22409eed47ac645c31717c1b4063dccbd2a11319892d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\daemon.dll

Filesize
405KB

MD5
ff1febcbe870732f1d5c05249bf170bd

SHA1
8389262982ea518203e791e9aa3b7d2f05b68968

SHA256
c73619449cea5194e5d8b43bd45758419853dc6cf67fdc0d6c561011671e1007

SHA512
a331e333edf690975ec374ac385aa40f1c55c8e7ee0e5e8d486ef0a841623a8dad1eacf99442818c9085545796ef903909f4293731b4d5b7ed8ba11681fee682

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\uactmon.dll

Filesize
378KB

MD5
b5efa5d82e2d5e56641df5f51c2f4fa9

SHA1
6dd68d5409f919ee85998b8c8767fd9dba0b221b

SHA256
d54e680de12427dee9bd3f1681c388b9d68856bf05a04aaf8f3285acc02e9a62

SHA512
35ccab5891c9ffd75ea0a509920ccd7ddb44797ea47c03440a52fc166cb94e16889c2dfedb42b6a7bb5b21c8281af4202811705b1a1e6032687176131655bcd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\usysdiag.dll

Filesize
540KB

MD5
c47671c720673da9d7c86a6a3061fc7c

SHA1
7f1aae332ab66715ba1f28b90391023d50166715

SHA256
f383c9c85c9eb343dc80054ea013ce9a25087d0b23844c1502be7dffcf5b4b84

SHA512
1534d579e050728cb11c6d8b13ef94349e52409a08bae7c45d6e9cf51ff9763b2e2280758fbaeb1a7a82af02abb956ff5edf65683d45dd05167141492f55b529

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\libcodecs.dll

Filesize
1.1MB

MD5
6450f7382ab6829ab19e46f05ebe1a35

SHA1
72218a55a97b537b45c5435eed7dcf405d86cd78

SHA256
2a20f321c58f83e0cb79000033abbd5dcbe94feb91272a77f959069395289561

SHA512
eba474847a254dc6bf0ebc2f1b09981ea2960e386be27ccb53f878a5a296c2309645e55909e36a2a524c391b1b0ae44b103128580461d96b8f1a981f0a00db66

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\libxsse.dll

Filesize
855KB

MD5
d2858da36e52ea8479ca5ecfe8b3affc

SHA1
17056f0944025576b1d0288bb17e9ed19b406bdb

SHA256
5900caf6adf8b53f632a85897608200d76e1848e53d50fc4477901524a9ff48a

SHA512
f2ff9a55fdd992a5eea37a51779322ca893ff4e0256819ef2ba7ed0e41d7079f2d62401554f67ac379fb59b69b00a43f8f85194c33cb41e2162329ef403a4790

Download Submit
memory/4884-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/4884-59-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download