965ddd7f32d239f30f2b06d754ae146c0bb420ed89f599823f9b3b08f73f14fe

General

Target

127baaa04b2c8b5209d43735d6f10bdc.exe
Size

751KB
MD5

127baaa04b2c8b5209d43735d6f10bdc
SHA1

e18164b6ddfa938757ebd999378e7a4f27c4238b
SHA256

965ddd7f32d239f30f2b06d754ae146c0bb420ed89f599823f9b3b08f73f14fe
SHA512

a82b543ee6e68a9314787744ef8260184a31db2b41de9b8a5ecf62e97088e850e41868e4e57de03d90dc5741d17f23854076846be838c0aac0fea7d19f9269ab
SSDEEP

1536:aZqjVsi+ylk2986K0brue5rIaTOKH0WkDKjpT0X:7VRhlk6jKKruW0sYKjpAX

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\M-4729467204670245028624525\winsvc.exe = "C:\\Users\\Admin\\M-4729467204670245028624525\\winsvc.exe:*:Enabled:Microsoft Windows Service"	127baaa04b2c8b5209d43735d6f10bdc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	127baaa04b2c8b5209d43735d6f10bdc.exe

Executes dropped EXE 2 IoCs

pid	Process
2804	winsvc.exe
2868	winsvc.exe

Loads dropped DLL 1 IoCs

pid	Process
2876	127baaa04b2c8b5209d43735d6f10bdc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Users\\Admin\\M-4729467204670245028624525\\winsvc.exe"	127baaa04b2c8b5209d43735d6f10bdc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2200 set thread context of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2804 set thread context of 2868	2804	winsvc.exe	30

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2200 wrote to memory of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2200 wrote to memory of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2200 wrote to memory of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2200 wrote to memory of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2200 wrote to memory of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2200 wrote to memory of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2200 wrote to memory of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2200 wrote to memory of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2200 wrote to memory of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2200 wrote to memory of 2876	2200	127baaa04b2c8b5209d43735d6f10bdc.exe	28
PID 2876 wrote to memory of 2804	2876	127baaa04b2c8b5209d43735d6f10bdc.exe	29
PID 2876 wrote to memory of 2804	2876	127baaa04b2c8b5209d43735d6f10bdc.exe	29
PID 2876 wrote to memory of 2804	2876	127baaa04b2c8b5209d43735d6f10bdc.exe	29
PID 2876 wrote to memory of 2804	2876	127baaa04b2c8b5209d43735d6f10bdc.exe	29
PID 2804 wrote to memory of 2868	2804	winsvc.exe	30
PID 2804 wrote to memory of 2868	2804	winsvc.exe	30
PID 2804 wrote to memory of 2868	2804	winsvc.exe	30
PID 2804 wrote to memory of 2868	2804	winsvc.exe	30
PID 2804 wrote to memory of 2868	2804	winsvc.exe	30
PID 2804 wrote to memory of 2868	2804	winsvc.exe	30
PID 2804 wrote to memory of 2868	2804	winsvc.exe	30
PID 2804 wrote to memory of 2868	2804	winsvc.exe	30
PID 2804 wrote to memory of 2868	2804	winsvc.exe	30
PID 2804 wrote to memory of 2868	2804	winsvc.exe	30
PID 2804 wrote to memory of 2868	2804	winsvc.exe	30

C:\Users\Admin\AppData\Local\Temp\127baaa04b2c8b5209d43735d6f10bdc.exe
"C:\Users\Admin\AppData\Local\Temp\127baaa04b2c8b5209d43735d6f10bdc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\127baaa04b2c8b5209d43735d6f10bdc.exe
  "C:\Users\Admin\AppData\Local\Temp\127baaa04b2c8b5209d43735d6f10bdc.exe"
  2⤵
  - Modifies firewall policy service
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Users\Admin\M-4729467204670245028624525\winsvc.exe
    C:\Users\Admin\M-4729467204670245028624525\winsvc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Users\Admin\M-4729467204670245028624525\winsvc.exe
      C:\Users\Admin\M-4729467204670245028624525\winsvc.exe
      4⤵
      Executes dropped EXE
      PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\M-4729467204670245028624525\winsvc.exe

Filesize
751KB

MD5
127baaa04b2c8b5209d43735d6f10bdc

SHA1
e18164b6ddfa938757ebd999378e7a4f27c4238b

SHA256
965ddd7f32d239f30f2b06d754ae146c0bb420ed89f599823f9b3b08f73f14fe

SHA512
a82b543ee6e68a9314787744ef8260184a31db2b41de9b8a5ecf62e97088e850e41868e4e57de03d90dc5741d17f23854076846be838c0aac0fea7d19f9269ab

Download Submit
memory/2200-1-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2200-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2804-32-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2804-29-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2868-51-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2868-50-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2876-7-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2876-15-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2876-18-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2876-19-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2876-20-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2876-13-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2876-11-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2876-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2876-4-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2876-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads