e4d9f8ff751e0e677ae8c46dcd97f05acbac29dfd3da099ec1ebc782bd8666ab

General

Target

12917cf3ff822ee7501f05062d4b1ec5.exe
Size

74KB
MD5

12917cf3ff822ee7501f05062d4b1ec5
SHA1

ae259add024873aab478033b6176dfd1b28b17c6
SHA256

e4d9f8ff751e0e677ae8c46dcd97f05acbac29dfd3da099ec1ebc782bd8666ab
SHA512

3b376fec9752cfb740b6841050e291d15f522953c636a978e7ebcb4c378dc2902459a82f49745f49f835516e7fba9670ceab64bcfc2cd2a589e63c439989f78f
SSDEEP

768:7TQtpx2j8pMfeGBqA3jbkiQ9uxGaNTzz68UlTCF3iMLeY+t0i9dJ7yZ4FyHTl+Et:7Kqj1hBBPas3eNlyIt04hFyHTm3z/V2

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	12917cf3ff822ee7501f05062d4b1ec5.exe

Executes dropped EXE 3 IoCs

pid	Process
792	ssmarque.scr
4524	System32.exe
3852	ssmarque.scr

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\System32.exe	12917cf3ff822ee7501f05062d4b1ec5.exe
File opened for modification	C:\Windows\SysWOW64\System32.exe	12917cf3ff822ee7501f05062d4b1ec5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	System32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	System32.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	System32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	System32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	System32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	System32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	System32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	System32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000005568b03fec38da01	System32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 01000000000000005568b03fec38da01	System32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3408	12917cf3ff822ee7501f05062d4b1ec5.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 792	3408	12917cf3ff822ee7501f05062d4b1ec5.exe	90
PID 3408 wrote to memory of 792	3408	12917cf3ff822ee7501f05062d4b1ec5.exe	90
PID 3408 wrote to memory of 792	3408	12917cf3ff822ee7501f05062d4b1ec5.exe	90
PID 4524 wrote to memory of 3852	4524	System32.exe	94
PID 4524 wrote to memory of 3852	4524	System32.exe	94
PID 4524 wrote to memory of 3852	4524	System32.exe	94
PID 3408 wrote to memory of 2024	3408	12917cf3ff822ee7501f05062d4b1ec5.exe	96
PID 3408 wrote to memory of 2024	3408	12917cf3ff822ee7501f05062d4b1ec5.exe	96
PID 3408 wrote to memory of 2024	3408	12917cf3ff822ee7501f05062d4b1ec5.exe	96

C:\Users\Admin\AppData\Local\Temp\12917cf3ff822ee7501f05062d4b1ec5.exe
"C:\Users\Admin\AppData\Local\Temp\12917cf3ff822ee7501f05062d4b1ec5.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3408
- C:\ssmarque.scr
  "C:\ssmarque.scr" /S
  2⤵
  - Executes dropped EXE
  PID:792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\12917C~1.EXE > nul
  2⤵
  PID:2024

C:\Windows\SysWOW64\System32.exe
C:\Windows\SysWOW64\System32.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4524
- C:\ssmarque.scr
  "C:\ssmarque.scr" /S
  2⤵
  - Executes dropped EXE
  PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\System32.exe

Filesize
74KB

MD5
12917cf3ff822ee7501f05062d4b1ec5

SHA1
ae259add024873aab478033b6176dfd1b28b17c6

SHA256
e4d9f8ff751e0e677ae8c46dcd97f05acbac29dfd3da099ec1ebc782bd8666ab

SHA512
3b376fec9752cfb740b6841050e291d15f522953c636a978e7ebcb4c378dc2902459a82f49745f49f835516e7fba9670ceab64bcfc2cd2a589e63c439989f78f

Download Submit
C:\ssmarque.scr

Filesize
8KB

MD5
3e9f18d134cb34e0575365bdad55f155

SHA1
14206f0887576eabe296b15881260b3ad2bf7709

SHA256
0cd0bcb93e7d4fa0fe4db223e914e723b4ebb4d81312cb4357f36a14edba2df2

SHA512
77a1353217df765ffd74f3b4b464c1edd86b8386e30aabda218e5d5610a981c7720164f9acda045fed5ed5c2cd914a144637a86d08b492a5b7f04bcb3b007612

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads