e4d9f8ff751e0e677ae8c46dcd97f05acbac29dfd3da099ec1ebc782bd8666ab

General

Target

12917cf3ff822ee7501f05062d4b1ec5.exe
Size

74KB
MD5

12917cf3ff822ee7501f05062d4b1ec5
SHA1

ae259add024873aab478033b6176dfd1b28b17c6
SHA256

e4d9f8ff751e0e677ae8c46dcd97f05acbac29dfd3da099ec1ebc782bd8666ab
SHA512

3b376fec9752cfb740b6841050e291d15f522953c636a978e7ebcb4c378dc2902459a82f49745f49f835516e7fba9670ceab64bcfc2cd2a589e63c439989f78f
SSDEEP

768:7TQtpx2j8pMfeGBqA3jbkiQ9uxGaNTzz68UlTCF3iMLeY+t0i9dJ7yZ4FyHTl+Et:7Kqj1hBBPas3eNlyIt04hFyHTm3z/V2

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1564	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
1340	ssmarque.scr
2228	System32.exe
2356	ssmarque.scr

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\System32.exe	12917cf3ff822ee7501f05062d4b1ec5.exe
File created	C:\Windows\SysWOW64\System32.exe	12917cf3ff822ee7501f05062d4b1ec5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	System32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	System32.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{B155BDF8-02F0-451E-9A26-AE317CFD7779} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000070827951ec38da01	System32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	System32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	System32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	System32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	System32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000010217751ec38da01	System32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2164	12917cf3ff822ee7501f05062d4b1ec5.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 1340	2164	12917cf3ff822ee7501f05062d4b1ec5.exe	28
PID 2164 wrote to memory of 1340	2164	12917cf3ff822ee7501f05062d4b1ec5.exe	28
PID 2164 wrote to memory of 1340	2164	12917cf3ff822ee7501f05062d4b1ec5.exe	28
PID 2164 wrote to memory of 1340	2164	12917cf3ff822ee7501f05062d4b1ec5.exe	28
PID 2228 wrote to memory of 2356	2228	System32.exe	30
PID 2228 wrote to memory of 2356	2228	System32.exe	30
PID 2228 wrote to memory of 2356	2228	System32.exe	30
PID 2228 wrote to memory of 2356	2228	System32.exe	30
PID 2164 wrote to memory of 1564	2164	12917cf3ff822ee7501f05062d4b1ec5.exe	31
PID 2164 wrote to memory of 1564	2164	12917cf3ff822ee7501f05062d4b1ec5.exe	31
PID 2164 wrote to memory of 1564	2164	12917cf3ff822ee7501f05062d4b1ec5.exe	31
PID 2164 wrote to memory of 1564	2164	12917cf3ff822ee7501f05062d4b1ec5.exe	31

C:\Users\Admin\AppData\Local\Temp\12917cf3ff822ee7501f05062d4b1ec5.exe
"C:\Users\Admin\AppData\Local\Temp\12917cf3ff822ee7501f05062d4b1ec5.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2164
- C:\ssmarque.scr
  "C:\ssmarque.scr" /S
  2⤵
  - Executes dropped EXE
  PID:1340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\12917C~1.EXE > nul
  2⤵
  - Deletes itself
  PID:1564

C:\Windows\SysWOW64\System32.exe
C:\Windows\SysWOW64\System32.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2228
- C:\ssmarque.scr
  "C:\ssmarque.scr" /S
  2⤵
  - Executes dropped EXE
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\System32.exe

Filesize
74KB

MD5
12917cf3ff822ee7501f05062d4b1ec5

SHA1
ae259add024873aab478033b6176dfd1b28b17c6

SHA256
e4d9f8ff751e0e677ae8c46dcd97f05acbac29dfd3da099ec1ebc782bd8666ab

SHA512
3b376fec9752cfb740b6841050e291d15f522953c636a978e7ebcb4c378dc2902459a82f49745f49f835516e7fba9670ceab64bcfc2cd2a589e63c439989f78f

Download Submit
C:\ssmarque.scr

Filesize
8KB

MD5
3e9f18d134cb34e0575365bdad55f155

SHA1
14206f0887576eabe296b15881260b3ad2bf7709

SHA256
0cd0bcb93e7d4fa0fe4db223e914e723b4ebb4d81312cb4357f36a14edba2df2

SHA512
77a1353217df765ffd74f3b4b464c1edd86b8386e30aabda218e5d5610a981c7720164f9acda045fed5ed5c2cd914a144637a86d08b492a5b7f04bcb3b007612

Download Submit

Analysis

Sharing