965ddd7f32d239f30f2b06d754ae146c0bb420ed89f599823f9b3b08f73f14fe

General

Target

127baaa04b2c8b5209d43735d6f10bdc.exe
Size

751KB
MD5

127baaa04b2c8b5209d43735d6f10bdc
SHA1

e18164b6ddfa938757ebd999378e7a4f27c4238b
SHA256

965ddd7f32d239f30f2b06d754ae146c0bb420ed89f599823f9b3b08f73f14fe
SHA512

a82b543ee6e68a9314787744ef8260184a31db2b41de9b8a5ecf62e97088e850e41868e4e57de03d90dc5741d17f23854076846be838c0aac0fea7d19f9269ab
SSDEEP

1536:aZqjVsi+ylk2986K0brue5rIaTOKH0WkDKjpT0X:7VRhlk6jKKruW0sYKjpAX

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\M-4729467204670245028624525\winsvc.exe = "C:\\Users\\Admin\\M-4729467204670245028624525\\winsvc.exe:*:Enabled:Microsoft Windows Service"	127baaa04b2c8b5209d43735d6f10bdc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	127baaa04b2c8b5209d43735d6f10bdc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	127baaa04b2c8b5209d43735d6f10bdc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	127baaa04b2c8b5209d43735d6f10bdc.exe

Executes dropped EXE 2 IoCs

pid	Process
1800	winsvc.exe
1700	winsvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Users\\Admin\\M-4729467204670245028624525\\winsvc.exe"	127baaa04b2c8b5209d43735d6f10bdc.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2096 set thread context of 2948	2096	127baaa04b2c8b5209d43735d6f10bdc.exe	91
PID 1800 set thread context of 1700	1800	winsvc.exe	93

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2948	2096	127baaa04b2c8b5209d43735d6f10bdc.exe	91
PID 2096 wrote to memory of 2948	2096	127baaa04b2c8b5209d43735d6f10bdc.exe	91
PID 2096 wrote to memory of 2948	2096	127baaa04b2c8b5209d43735d6f10bdc.exe	91
PID 2096 wrote to memory of 2948	2096	127baaa04b2c8b5209d43735d6f10bdc.exe	91
PID 2096 wrote to memory of 2948	2096	127baaa04b2c8b5209d43735d6f10bdc.exe	91
PID 2096 wrote to memory of 2948	2096	127baaa04b2c8b5209d43735d6f10bdc.exe	91
PID 2096 wrote to memory of 2948	2096	127baaa04b2c8b5209d43735d6f10bdc.exe	91
PID 2096 wrote to memory of 2948	2096	127baaa04b2c8b5209d43735d6f10bdc.exe	91
PID 2096 wrote to memory of 2948	2096	127baaa04b2c8b5209d43735d6f10bdc.exe	91
PID 2096 wrote to memory of 2948	2096	127baaa04b2c8b5209d43735d6f10bdc.exe	91
PID 2948 wrote to memory of 1800	2948	127baaa04b2c8b5209d43735d6f10bdc.exe	92
PID 2948 wrote to memory of 1800	2948	127baaa04b2c8b5209d43735d6f10bdc.exe	92
PID 2948 wrote to memory of 1800	2948	127baaa04b2c8b5209d43735d6f10bdc.exe	92
PID 1800 wrote to memory of 1700	1800	winsvc.exe	93
PID 1800 wrote to memory of 1700	1800	winsvc.exe	93
PID 1800 wrote to memory of 1700	1800	winsvc.exe	93
PID 1800 wrote to memory of 1700	1800	winsvc.exe	93
PID 1800 wrote to memory of 1700	1800	winsvc.exe	93
PID 1800 wrote to memory of 1700	1800	winsvc.exe	93
PID 1800 wrote to memory of 1700	1800	winsvc.exe	93
PID 1800 wrote to memory of 1700	1800	winsvc.exe	93
PID 1800 wrote to memory of 1700	1800	winsvc.exe	93
PID 1800 wrote to memory of 1700	1800	winsvc.exe	93

C:\Users\Admin\AppData\Local\Temp\127baaa04b2c8b5209d43735d6f10bdc.exe
"C:\Users\Admin\AppData\Local\Temp\127baaa04b2c8b5209d43735d6f10bdc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Users\Admin\AppData\Local\Temp\127baaa04b2c8b5209d43735d6f10bdc.exe
  "C:\Users\Admin\AppData\Local\Temp\127baaa04b2c8b5209d43735d6f10bdc.exe"
  2⤵
  - Modifies firewall policy service
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2948
- - C:\Users\Admin\M-4729467204670245028624525\winsvc.exe
    C:\Users\Admin\M-4729467204670245028624525\winsvc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - C:\Users\Admin\M-4729467204670245028624525\winsvc.exe
      C:\Users\Admin\M-4729467204670245028624525\winsvc.exe
      4⤵
      Executes dropped EXE
      PID:1700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\M-4729467204670245028624525\winsvc.exe

Filesize
751KB

MD5
127baaa04b2c8b5209d43735d6f10bdc

SHA1
e18164b6ddfa938757ebd999378e7a4f27c4238b

SHA256
965ddd7f32d239f30f2b06d754ae146c0bb420ed89f599823f9b3b08f73f14fe

SHA512
a82b543ee6e68a9314787744ef8260184a31db2b41de9b8a5ecf62e97088e850e41868e4e57de03d90dc5741d17f23854076846be838c0aac0fea7d19f9269ab

Download Submit
memory/1700-20-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1700-21-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1800-14-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/1800-15-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2096-0-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2096-1-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/2948-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2948-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2948-5-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2948-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads