f01e8bc34f521a846f58072c86f22eb920e4389244fa7eccae973b2bdc5781aa

General

Target

0dbbbfda3be63153770863cc8ee46759.exe
Size

70KB
MD5

0dbbbfda3be63153770863cc8ee46759
SHA1

db3f259ae39428b221b73714313c5b1552c4bd6b
SHA256

f01e8bc34f521a846f58072c86f22eb920e4389244fa7eccae973b2bdc5781aa
SHA512

42f1e1aa6ba81de25eb5c8e8967fc4e90990ba34eae9a763e042a965fc6204cb78202b4f27dfa30557b23d4a12625c2fe4e21006845983e66f50085d0f7e3ef7
SSDEEP

1536:oRyTmpjkbXzcY9gXKpremrCIsZJ1EZ62lXbO3dRTBsl6+:czp8j0cremGIG/2lC3NM6+

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	0dbbbfda3be63153770863cc8ee46759.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	0dbbbfda3be63153770863cc8ee46759.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Public\msnl.exe = "C:\\Users\\Public\\msnl.exe:*:Enabled:Windows System Guard"	0dbbbfda3be63153770863cc8ee46759.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	0dbbbfda3be63153770863cc8ee46759.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	0dbbbfda3be63153770863cc8ee46759.exe

Executes dropped EXE 2 IoCs

pid	Process
4984	msnl.exe
4616	msnl.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4136-0-0x0000000000400000-0x0000000000417001-memory.dmp	upx
behavioral2/memory/4136-5-0x0000000000400000-0x0000000000417001-memory.dmp	upx
behavioral2/files/0x0009000000023117-12.dat	upx
behavioral2/memory/4984-76-0x0000000000400000-0x0000000000417001-memory.dmp	upx
behavioral2/files/0x0009000000023117-74.dat	upx
behavioral2/memory/4984-68-0x0000000000400000-0x0000000000417001-memory.dmp	upx
behavioral2/files/0x0009000000023117-67.dat	upx
behavioral2/files/0x0009000000023117-66.dat	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows System Guard = "C:\\Users\\Public\\msnl.exe"	0dbbbfda3be63153770863cc8ee46759.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows System Guard = "C:\\Users\\Public\\msnl.exe"	0dbbbfda3be63153770863cc8ee46759.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4136 set thread context of 4664	4136	0dbbbfda3be63153770863cc8ee46759.exe	17
PID 4984 set thread context of 4616	4984	msnl.exe	43

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	0dbbbfda3be63153770863cc8ee46759.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4136	0dbbbfda3be63153770863cc8ee46759.exe
4984	msnl.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4664	4136	0dbbbfda3be63153770863cc8ee46759.exe	17
PID 4136 wrote to memory of 4664	4136	0dbbbfda3be63153770863cc8ee46759.exe	17
PID 4136 wrote to memory of 4664	4136	0dbbbfda3be63153770863cc8ee46759.exe	17
PID 4136 wrote to memory of 4664	4136	0dbbbfda3be63153770863cc8ee46759.exe	17
PID 4136 wrote to memory of 4664	4136	0dbbbfda3be63153770863cc8ee46759.exe	17
PID 4136 wrote to memory of 4664	4136	0dbbbfda3be63153770863cc8ee46759.exe	17
PID 4136 wrote to memory of 4664	4136	0dbbbfda3be63153770863cc8ee46759.exe	17
PID 4136 wrote to memory of 4664	4136	0dbbbfda3be63153770863cc8ee46759.exe	17
PID 4664 wrote to memory of 4984	4664	0dbbbfda3be63153770863cc8ee46759.exe	42
PID 4664 wrote to memory of 4984	4664	0dbbbfda3be63153770863cc8ee46759.exe	42
PID 4664 wrote to memory of 4984	4664	0dbbbfda3be63153770863cc8ee46759.exe	42
PID 4984 wrote to memory of 4616	4984	msnl.exe	43
PID 4984 wrote to memory of 4616	4984	msnl.exe	43
PID 4984 wrote to memory of 4616	4984	msnl.exe	43
PID 4984 wrote to memory of 4616	4984	msnl.exe	43
PID 4984 wrote to memory of 4616	4984	msnl.exe	43
PID 4984 wrote to memory of 4616	4984	msnl.exe	43
PID 4984 wrote to memory of 4616	4984	msnl.exe	43
PID 4984 wrote to memory of 4616	4984	msnl.exe	43

C:\Users\Admin\AppData\Local\Temp\0dbbbfda3be63153770863cc8ee46759.exe
"C:\Users\Admin\AppData\Local\Temp\0dbbbfda3be63153770863cc8ee46759.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\0dbbbfda3be63153770863cc8ee46759.exe
  C:\Users\Admin\AppData\Local\Temp\0dbbbfda3be63153770863cc8ee46759.exe
  2⤵
  - Modifies firewall policy service
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Users\Public\msnl.exe
    "C:\Users\Public\msnl.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4984
  - - C:\Users\Public\msnl.exe
      C:\Users\Public\msnl.exe
      4⤵
      Executes dropped EXE
      PID:4616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\msnl.exe

Filesize
1KB

MD5
178534346465bb809abf9e95858962d4

SHA1
3dce3b5f28b4062c6528bc405ec1ed8da2049d41

SHA256
46ee619fd612990d6e138d1469722ca9d73818353de0e6811e5dab426aaf17c0

SHA512
ceb594807292f1d084b0827bca7cc4c00c09d281e976183cb923d814ff76ac1828d982dc79521c1b2284591b3c0e834df87b264c154461253f515e31a143eb3e

Download Submit
C:\Users\Public\msnl.exe

Filesize
53KB

MD5
9603360df2065bd8e5345f8e32544d6c

SHA1
96281e7f6d4e2fb58bedbb40288739ca6b3a2a7c

SHA256
a87015b4957903e1832dea6f734085da56528fab043e15b2c626c04ce35ac79f

SHA512
94ef2b63908894bac09d50e787e4e8bf67e577a95a63614b9af68fa76b131c86b010c18fd2f162a9948885d8ce6e577bf7987909231bbe34544fe1ff10a93be6

Download Submit
C:\Users\Public\msnl.exe

Filesize
41KB

MD5
3eeed41a748e6c760f7f72e06c4d4d1a

SHA1
58abe8292ca8a094b5a7b5684cf0892f03678849

SHA256
8d21eb596955042c3d09af8ade55ab3fb57bb4f2b2cbcc066120fa3e4835bba6

SHA512
4715806468351120c192cab496cb529f9a83f2490644ea322b2631cc54055fcc65e0e71cd0a67d5f1778f1576d303fda7cb4791fbf4014e17176931c7f19cdbf

Download Submit
C:\Users\Public\msnl.exe

Filesize
70KB

MD5
0dbbbfda3be63153770863cc8ee46759

SHA1
db3f259ae39428b221b73714313c5b1552c4bd6b

SHA256
f01e8bc34f521a846f58072c86f22eb920e4389244fa7eccae973b2bdc5781aa

SHA512
42f1e1aa6ba81de25eb5c8e8967fc4e90990ba34eae9a763e042a965fc6204cb78202b4f27dfa30557b23d4a12625c2fe4e21006845983e66f50085d0f7e3ef7

Download Submit
memory/4136-5-0x0000000000400000-0x0000000000417001-memory.dmp

Filesize
92KB

Download
memory/4136-0-0x0000000000400000-0x0000000000417001-memory.dmp

Filesize
92KB

Download
memory/4616-79-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4616-77-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4616-78-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4664-69-0x0000000000410000-0x00000000004D9000-memory.dmp

Filesize
804KB

Download
memory/4664-3-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4664-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4664-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4984-76-0x0000000000400000-0x0000000000417001-memory.dmp

Filesize
92KB

Download
memory/4984-68-0x0000000000400000-0x0000000000417001-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads