b4aeb2134f7a1ad5713e74686b8406b021cd991e2a0701dcf74b52f737aed07b

General

Target

060210cc7637d170e963a4873a03c103.exe
Size

180KB
MD5

060210cc7637d170e963a4873a03c103
SHA1

bddf8010fe6815056671d56cc1c3996155ff5953
SHA256

b4aeb2134f7a1ad5713e74686b8406b021cd991e2a0701dcf74b52f737aed07b
SHA512

3c1d3f06fbeccd9138f4533b9c93d8cf1cc6ad350cd134a193e71dd5c3254ec91b6a9c002d0e54a5d86e03fdb24f91347262f6f63aeb8b83c11b912ce24a1874
SSDEEP

3072:LDOGVDoOzGVv73HNYFg83zA8a7w/++ILFMKsvh4mMpA27RqpCwNLYpoAqQ:LDOAD3cdY53Ja7w/+ZLFhmMPQCWL9

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2888	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
1100	Explorer.EXE
480	services.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3601492379-692465709-652514833-1000\\$4b462f9e22bc76ad0327dff9b25f4f5f\\n."	060210cc7637d170e963a4873a03c103.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$4b462f9e22bc76ad0327dff9b25f4f5f\\n."	060210cc7637d170e963a4873a03c103.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	060210cc7637d170e963a4873a03c103.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	060210cc7637d170e963a4873a03c103.exe

Unexpected DNS network traffic destination 9 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	services.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	services.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 2888	1668	060210cc7637d170e963a4873a03c103.exe	29

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3601492379-692465709-652514833-1000\\$4b462f9e22bc76ad0327dff9b25f4f5f\\n."	060210cc7637d170e963a4873a03c103.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$4b462f9e22bc76ad0327dff9b25f4f5f\\n."	060210cc7637d170e963a4873a03c103.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\clsid	060210cc7637d170e963a4873a03c103.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	060210cc7637d170e963a4873a03c103.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	060210cc7637d170e963a4873a03c103.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	060210cc7637d170e963a4873a03c103.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1668	060210cc7637d170e963a4873a03c103.exe
1668	060210cc7637d170e963a4873a03c103.exe
1668	060210cc7637d170e963a4873a03c103.exe
1668	060210cc7637d170e963a4873a03c103.exe
1668	060210cc7637d170e963a4873a03c103.exe
1668	060210cc7637d170e963a4873a03c103.exe
480	services.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1668	060210cc7637d170e963a4873a03c103.exe
Token: SeDebugPrivilege	1668	060210cc7637d170e963a4873a03c103.exe
Token: SeDebugPrivilege	1668	060210cc7637d170e963a4873a03c103.exe
Token: SeDebugPrivilege	480	services.exe
Token: SeBackupPrivilege	480	services.exe
Token: SeRestorePrivilege	480	services.exe
Token: SeSecurityPrivilege	480	services.exe
Token: SeTakeOwnershipPrivilege	480	services.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1100	1668	060210cc7637d170e963a4873a03c103.exe	10
PID 1668 wrote to memory of 1100	1668	060210cc7637d170e963a4873a03c103.exe	10
PID 1668 wrote to memory of 480	1668	060210cc7637d170e963a4873a03c103.exe	22
PID 1668 wrote to memory of 2888	1668	060210cc7637d170e963a4873a03c103.exe	29
PID 1668 wrote to memory of 2888	1668	060210cc7637d170e963a4873a03c103.exe	29
PID 1668 wrote to memory of 2888	1668	060210cc7637d170e963a4873a03c103.exe	29
PID 1668 wrote to memory of 2888	1668	060210cc7637d170e963a4873a03c103.exe	29
PID 1668 wrote to memory of 2888	1668	060210cc7637d170e963a4873a03c103.exe	29

C:\Users\Admin\AppData\Local\Temp\060210cc7637d170e963a4873a03c103.exe
"C:\Users\Admin\AppData\Local\Temp\060210cc7637d170e963a4873a03c103.exe"
1⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Deletes itself
  PID:2888

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
PID:1100

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/480-16-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1100-6-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1100-11-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1100-22-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1668-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1668-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/1668-3-0x0000000000230000-0x0000000000262000-memory.dmp

Filesize
200KB

Download
memory/1668-4-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1668-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1668-5-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1668-21-0x0000000000230000-0x0000000000262000-memory.dmp

Filesize
200KB

Download
memory/1668-20-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads