7457259704b46b977bb16fefeef88b74135c501a011a7769811daa53806deebf

General

Target

4a7693ac14a86fa54a7256d07214a77e.exe
Size

65KB
MD5

4a7693ac14a86fa54a7256d07214a77e
SHA1

493501e0244a9cb95969894e814f883e5ee956b0
SHA256

7457259704b46b977bb16fefeef88b74135c501a011a7769811daa53806deebf
SHA512

528e78669a6c00e0c7400dd6f3ef9bb9d775ac3cf9b84c46e5c6fc198a677ae463061d448c5a803549589f8ec16645f07f6509a9e9d341130d0a7a096256a843
SSDEEP

1536:FHAGkBshHhHhoQR1SdkE6vC7fcEcUymZ/oWHxfwLvZmit:FgGkeSX6ab7VT/BJwLvZxt

Score

8^/10

persistence upx

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{26521FVQ-C47O-G1M7-LT2T-RE5XG686F25S}	4a7693ac14a86fa54a7256d07214a77e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{26521FVQ-C47O-G1M7-LT2T-RE5XG686F25S}\StubPath = "C:\\Program Files (x86)\\Microsoft\\dofawo.exe Restart"	4a7693ac14a86fa54a7256d07214a77e.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{26521FVQ-C47O-G1M7-LT2T-RE5XG686F25S}	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{26521FVQ-C47O-G1M7-LT2T-RE5XG686F25S}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\dofawo.exe Restart"	svchost.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2680-8-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/2680-7-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/2380-19-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/2380-22-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/2680-25-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/2380-15-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/2680-6-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/2680-3-0x0000000010000000-0x000000001002E000-memory.dmp	upx
behavioral1/memory/2380-27-0x0000000010000000-0x000000001002E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Protection = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\dofawo.exe"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Protection = "C:\\Program Files (x86)\\Microsoft\\dofawo.exe"	4a7693ac14a86fa54a7256d07214a77e.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1628 set thread context of 2680	1628	4a7693ac14a86fa54a7256d07214a77e.exe	18
PID 2680 set thread context of 2380	2680	4a7693ac14a86fa54a7256d07214a77e.exe	16

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\dofawo.exe	4a7693ac14a86fa54a7256d07214a77e.exe
File opened for modification	C:\Program Files (x86)\Microsoft\dofawo.exe	svchost.exe
File created	C:\Program Files (x86)\Microsoft\dofawo.exe	svchost.exe
File created	C:\Program Files (x86)\Microsoft\dofawo.exe	4a7693ac14a86fa54a7256d07214a77e.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2752	2380	WerFault.exe	16

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2680	4a7693ac14a86fa54a7256d07214a77e.exe
2680	4a7693ac14a86fa54a7256d07214a77e.exe
2380	svchost.exe
2380	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2680	4a7693ac14a86fa54a7256d07214a77e.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2680	1628	4a7693ac14a86fa54a7256d07214a77e.exe	18
PID 1628 wrote to memory of 2680	1628	4a7693ac14a86fa54a7256d07214a77e.exe	18
PID 1628 wrote to memory of 2680	1628	4a7693ac14a86fa54a7256d07214a77e.exe	18
PID 1628 wrote to memory of 2680	1628	4a7693ac14a86fa54a7256d07214a77e.exe	18
PID 1628 wrote to memory of 2680	1628	4a7693ac14a86fa54a7256d07214a77e.exe	18
PID 1628 wrote to memory of 2680	1628	4a7693ac14a86fa54a7256d07214a77e.exe	18
PID 2680 wrote to memory of 2380	2680	4a7693ac14a86fa54a7256d07214a77e.exe	16
PID 2680 wrote to memory of 2380	2680	4a7693ac14a86fa54a7256d07214a77e.exe	16
PID 2680 wrote to memory of 2380	2680	4a7693ac14a86fa54a7256d07214a77e.exe	16
PID 2680 wrote to memory of 2380	2680	4a7693ac14a86fa54a7256d07214a77e.exe	16
PID 2680 wrote to memory of 2380	2680	4a7693ac14a86fa54a7256d07214a77e.exe	16
PID 2680 wrote to memory of 2380	2680	4a7693ac14a86fa54a7256d07214a77e.exe	16
PID 2680 wrote to memory of 1252	2680	4a7693ac14a86fa54a7256d07214a77e.exe	7
PID 2680 wrote to memory of 1252	2680	4a7693ac14a86fa54a7256d07214a77e.exe	7
PID 2680 wrote to memory of 1252	2680	4a7693ac14a86fa54a7256d07214a77e.exe	7
PID 2380 wrote to memory of 2752	2380	svchost.exe	17
PID 2380 wrote to memory of 2752	2380	svchost.exe	17
PID 2380 wrote to memory of 2752	2380	svchost.exe	17
PID 2380 wrote to memory of 2752	2380	svchost.exe	17

C:\Users\Admin\AppData\Local\Temp\4a7693ac14a86fa54a7256d07214a77e.exe
"C:\Users\Admin\AppData\Local\Temp\4a7693ac14a86fa54a7256d07214a77e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\4a7693ac14a86fa54a7256d07214a77e.exe
  "C:\Users\Admin\AppData\Local\Temp\4a7693ac14a86fa54a7256d07214a77e.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2680

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\system32\svchost.exe"
1⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 144
  2⤵
  - Program crash
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-16-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/1628-4-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2380-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2380-19-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2380-22-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2380-15-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2380-27-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2680-25-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2680-7-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2680-6-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2680-8-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2680-3-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2680-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2680-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads