6df36cff07a6b5e3da92d65093a27da77e11a7176553547df0c97e1c908abf99

General

Target

117b5c736180344d42c05c8d2e321f0a.exe
Size

120KB
MD5

117b5c736180344d42c05c8d2e321f0a
SHA1

f43568eed7550b326f1630a478802be4cec94842
SHA256

6df36cff07a6b5e3da92d65093a27da77e11a7176553547df0c97e1c908abf99
SHA512

97002e94952f6e599e6ff738fa49ff6c21e5a74e38d2c6e4e69a115c29e25a71640d24829242a4f091406a446700aa0c01adcbc0ba6fa3cdaa84bb9f40bb9df9
SSDEEP

1536:dRaYfD50cWIwhPxUCAufAewPyTx+nTTv2I27Z8YA2PPO4VtQNIhU3E:n4PxUjoAewbC8uPPO4VtwIhUU

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	117b5c736180344d42c05c8d2e321f0a.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\All Users\¡¸¿ªÊ¼¡¹²Ëµ¥\³ÌÐò\Æô¶¯\desktop.ini	117b5c736180344d42c05c8d2e321f0a.exe

Drops autorun.inf file 1 TTPs 6 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	\??\d:\autorun.inf	117b5c736180344d42c05c8d2e321f0a.exe
File opened for modification	\??\d:\autorun.inf	117b5c736180344d42c05c8d2e321f0a.exe
File created	\??\E:\autorun.inf	117b5c736180344d42c05c8d2e321f0a.exe
File opened for modification	\??\E:\autorun.inf	117b5c736180344d42c05c8d2e321f0a.exe
File created	F:\autorun.inf	117b5c736180344d42c05c8d2e321f0a.exe
File opened for modification	F:\autorun.inf	117b5c736180344d42c05c8d2e321f0a.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell\Open\Command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell\Open\Command\ = "\"D:\\Downloads\\system.exe\" \"%1\""	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\DefaultIcon	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini\ = "ini"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini\PersistentHandler\ = "{5e941d80-bf96-11cd-b579-08002b30bfeb}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\Shell\Open	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\EditFlags = "2"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ini	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ini\DefaultIcon\ = "D:\\Downloads\\system.exe,0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ini\PersistentHandler	regedit.exe

Runs .reg file with regedit 4 IoCs

pid	Process
3052	regedit.exe
2528	regedit.exe
3000	regedit.exe
3036	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	117b5c736180344d42c05c8d2e321f0a.exe
2100	117b5c736180344d42c05c8d2e321f0a.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	117b5c736180344d42c05c8d2e321f0a.exe
Token: SeDebugPrivilege	2100	117b5c736180344d42c05c8d2e321f0a.exe
Token: SeDebugPrivilege	2100	117b5c736180344d42c05c8d2e321f0a.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 3000	2100	117b5c736180344d42c05c8d2e321f0a.exe	28
PID 2100 wrote to memory of 3000	2100	117b5c736180344d42c05c8d2e321f0a.exe	28
PID 2100 wrote to memory of 3000	2100	117b5c736180344d42c05c8d2e321f0a.exe	28
PID 2100 wrote to memory of 3000	2100	117b5c736180344d42c05c8d2e321f0a.exe	28
PID 2100 wrote to memory of 3036	2100	117b5c736180344d42c05c8d2e321f0a.exe	29
PID 2100 wrote to memory of 3036	2100	117b5c736180344d42c05c8d2e321f0a.exe	29
PID 2100 wrote to memory of 3036	2100	117b5c736180344d42c05c8d2e321f0a.exe	29
PID 2100 wrote to memory of 3036	2100	117b5c736180344d42c05c8d2e321f0a.exe	29
PID 2100 wrote to memory of 3052	2100	117b5c736180344d42c05c8d2e321f0a.exe	30
PID 2100 wrote to memory of 3052	2100	117b5c736180344d42c05c8d2e321f0a.exe	30
PID 2100 wrote to memory of 3052	2100	117b5c736180344d42c05c8d2e321f0a.exe	30
PID 2100 wrote to memory of 3052	2100	117b5c736180344d42c05c8d2e321f0a.exe	30
PID 2100 wrote to memory of 2528	2100	117b5c736180344d42c05c8d2e321f0a.exe	31
PID 2100 wrote to memory of 2528	2100	117b5c736180344d42c05c8d2e321f0a.exe	31
PID 2100 wrote to memory of 2528	2100	117b5c736180344d42c05c8d2e321f0a.exe	31
PID 2100 wrote to memory of 2528	2100	117b5c736180344d42c05c8d2e321f0a.exe	31

C:\Users\Admin\AppData\Local\Temp\117b5c736180344d42c05c8d2e321f0a.exe
"C:\Users\Admin\AppData\Local\Temp\117b5c736180344d42c05c8d2e321f0a.exe"
1⤵
- Drops file in Drivers directory
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\1.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:3000
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\2.reg
  2⤵
  - Modifies registry class
  - Runs .reg file with regedit
  PID:3036
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\3.reg
  2⤵
  - Runs .reg file with regedit
  PID:3052
- C:\Windows\SysWOW64\regedit.exe
  regedit /s C:\4.reg
  2⤵
  - Runs .reg file with regedit
  PID:2528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\1.reg

Filesize
336B

MD5
aff0a7483b4295c9d4f7059d6987c144

SHA1
9261da4d585c62b8a5c2cc22d57a3262a1fb3207

SHA256
b82cf739343fdcf120f88f4f9c26f4e6d789ef7727ae08b7062f6bcae02eafda

SHA512
e5f0bcd93f25078d7ed7ab0ecc274f954606d5f9999a0e144fa558e3e7472e262a4c95f557b2e35fdf447b7cb46f082bc09912b8fb3da18d283448570d8d1b79

Download Submit
C:\2.reg

Filesize
846B

MD5
848edf0d0ca0fdb5f9ef5dfdfafb9fb0

SHA1
5ca91408f8c685b03477cc9b31da189271317165

SHA256
37605bc0480c0730df10bd28a3484ddbd3a79ceacc5889c7f5378ad83fded293

SHA512
1ad12652303a42ec7925332b0ba389faa4d3cda681c99e48c66256b76f0082b09ced5397e8f6ccc97e5450b2240ed4135efe96b1ead86894c888c7710778282b

Download Submit
C:\3.reg

Filesize
308B

MD5
70d3db7644483881fdf584b177167f5f

SHA1
b8d2b407cada74f07ce6aa0be4b9ca59a192fb2d

SHA256
377aaee81ce0e57da2caaa3266b2d8b07baabff20a9faa60a673fc3060ed83dc

SHA512
0c6205a55ff048b5e5d4db08233985a7be2ebf239005568a764bcc9ae8bbf132519ae5a6282f94c24f607c6843c71b704b527d2f995af70c5037aa609db4e882

Download Submit
C:\4.reg

Filesize
666B

MD5
4a1ead87c614b79543db4e519564e8ce

SHA1
72cb0454a3cdd57230647c6f250b43d238a20a67

SHA256
220e29b2fdd0aba4825108fb5c390656f104f5bcd21afcf5e0eea76b120aa358

SHA512
720fa78b543a2b33ccbf0945dbbfc36f431827f9b059fff1167250d17bcc9c224f2cd4cfe38d37caf785a8e3eb14b292f8d9db5f6ab5e2fbb5db3c91abc47f50

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads