6ca52315ca17b81c46c0f2bd930deb8fc295a78e81a30f03bcaf3f330b3b8a22

General

Target

1ea1904254b5424dcd3a07b0adf607f0.exe
Size

283KB
MD5

1ea1904254b5424dcd3a07b0adf607f0
SHA1

35ea55804a79e772d00766edc02b375df74eeb8a
SHA256

6ca52315ca17b81c46c0f2bd930deb8fc295a78e81a30f03bcaf3f330b3b8a22
SHA512

46a60c8a8a42e63fa4ba32b4db7c8fa28342ad9dbdf78cf49ef74cdd8b968d0ba16e72597da6d9b67416d2b9bfeda3bce298856c83ebd5ec1776bf23f2f781f4
SSDEEP

6144:tl5L7Q+1b+Nz65JvoanBCiIrRtEEztQZ/hmmeRg:P5L8akz6YjiIrbxtQZ/9eRg

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2332	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2328	ASP.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	ASP.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ASP.exe	1ea1904254b5424dcd3a07b0adf607f0.exe
File created	C:\Windows\uninstal.bat	1ea1904254b5424dcd3a07b0adf607f0.exe
File created	C:\Windows\ASP.exe	1ea1904254b5424dcd3a07b0adf607f0.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ASP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00c2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ASP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ASP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ASP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	ASP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE}\WpadDecisionReason = "1"	ASP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE}\WpadDecisionTime = 902b2eed5e39da01	ASP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ASP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE}\WpadNetworkName = "Network 3"	ASP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	ASP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE}\WpadDecision = "0"	ASP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE}	ASP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-35-74-fb-c4-dc\WpadDecision = "0"	ASP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	ASP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ASP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{0B6ABC94-F623-47C2-9F81-AB7C14E70CAE}\2e-35-74-fb-c4-dc	ASP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	ASP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ASP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ASP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-35-74-fb-c4-dc	ASP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-35-74-fb-c4-dc\WpadDecisionReason = "1"	ASP.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2e-35-74-fb-c4-dc\WpadDecisionTime = 902b2eed5e39da01	ASP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ASP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ASP.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	1ea1904254b5424dcd3a07b0adf607f0.exe
Token: SeDebugPrivilege	2328	ASP.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2328	ASP.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2328 wrote to memory of 2764	2328	ASP.exe	29
PID 2328 wrote to memory of 2764	2328	ASP.exe	29
PID 2328 wrote to memory of 2764	2328	ASP.exe	29
PID 2328 wrote to memory of 2764	2328	ASP.exe	29
PID 1736 wrote to memory of 2332	1736	1ea1904254b5424dcd3a07b0adf607f0.exe	30
PID 1736 wrote to memory of 2332	1736	1ea1904254b5424dcd3a07b0adf607f0.exe	30
PID 1736 wrote to memory of 2332	1736	1ea1904254b5424dcd3a07b0adf607f0.exe	30
PID 1736 wrote to memory of 2332	1736	1ea1904254b5424dcd3a07b0adf607f0.exe	30
PID 1736 wrote to memory of 2332	1736	1ea1904254b5424dcd3a07b0adf607f0.exe	30
PID 1736 wrote to memory of 2332	1736	1ea1904254b5424dcd3a07b0adf607f0.exe	30
PID 1736 wrote to memory of 2332	1736	1ea1904254b5424dcd3a07b0adf607f0.exe	30

C:\Users\Admin\AppData\Local\Temp\1ea1904254b5424dcd3a07b0adf607f0.exe
"C:\Users\Admin\AppData\Local\Temp\1ea1904254b5424dcd3a07b0adf607f0.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  PID:2332

C:\Windows\ASP.exe
C:\Windows\ASP.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2328
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2764

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\ASP.exe

Filesize
283KB

MD5
1ea1904254b5424dcd3a07b0adf607f0

SHA1
35ea55804a79e772d00766edc02b375df74eeb8a

SHA256
6ca52315ca17b81c46c0f2bd930deb8fc295a78e81a30f03bcaf3f330b3b8a22

SHA512
46a60c8a8a42e63fa4ba32b4db7c8fa28342ad9dbdf78cf49ef74cdd8b968d0ba16e72597da6d9b67416d2b9bfeda3bce298856c83ebd5ec1776bf23f2f781f4

Download Submit
C:\Windows\uninstal.bat

Filesize
190B

MD5
54f6724a8e27f71d7bd5912cfe07f358

SHA1
e8fc77ee22f6f10bb8caa19fde8c80c347265afb

SHA256
4c914704de58621dc82762b69b77e7c77f964a1338e4d422181967e0292c613d

SHA512
66235e5b88cc239dc236a29a269a1551fee5875f519fbbaa63000613bf1876b765245f8978afde7f063232ebd00f2bce426f7d930dc9f5c999b6161062cb4183

Download Submit
memory/1736-0-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/1736-1-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/1736-2-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1736-16-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2328-6-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2328-7-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2328-18-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2328-19-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing