71f26ec4de6a595881a1a235e29ffea8a4b0794000ffb780c2fe37e98ca34c76

General

Target

54d1ea41db69c34d3704c96515d5b1e9.exe
Size

300KB
MD5

54d1ea41db69c34d3704c96515d5b1e9
SHA1

25dada3cbd9b0a683a65df884cd76dc41897d219
SHA256

71f26ec4de6a595881a1a235e29ffea8a4b0794000ffb780c2fe37e98ca34c76
SHA512

864a24cb79bbc270cdd49c5fbb81c54f6243be2734b1834842e7219ce47c889e2f4c2b6d0f87326d775029dc87d2c9efbd2fe3f0383a62520cb27a04c988581a
SSDEEP

6144:RRLLNYTpkl9B1erzj1GY8/xA/iWHhblby8/1CaZSA/7bT0n/yX9:RstkJ1Qzj1GY8u/Nxlbyg1N/fTKyX9

Score

10^/10

evasion

Malware Config

Signatures

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe

Executes dropped EXE 1 IoCs

pid	Process
1564	win.exe

Loads dropped DLL 2 IoCs

pid	Process
2860	54d1ea41db69c34d3704c96515d5b1e9.exe
2860	54d1ea41db69c34d3704c96515d5b1e9.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	54d1ea41db69c34d3704c96515d5b1e9.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	54d1ea41db69c34d3704c96515d5b1e9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	win.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	win.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\win.exe	54d1ea41db69c34d3704c96515d5b1e9.exe
File opened for modification	C:\Windows\SysWOW64\win.exe	54d1ea41db69c34d3704c96515d5b1e9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2052 set thread context of 2860	2052	54d1ea41db69c34d3704c96515d5b1e9.exe	28

Runs .reg file with regedit 1 IoCs

pid	Process
1628	regedit.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2860	2052	54d1ea41db69c34d3704c96515d5b1e9.exe	28
PID 2052 wrote to memory of 2860	2052	54d1ea41db69c34d3704c96515d5b1e9.exe	28
PID 2052 wrote to memory of 2860	2052	54d1ea41db69c34d3704c96515d5b1e9.exe	28
PID 2052 wrote to memory of 2860	2052	54d1ea41db69c34d3704c96515d5b1e9.exe	28
PID 2052 wrote to memory of 2860	2052	54d1ea41db69c34d3704c96515d5b1e9.exe	28
PID 2052 wrote to memory of 2860	2052	54d1ea41db69c34d3704c96515d5b1e9.exe	28
PID 2052 wrote to memory of 2860	2052	54d1ea41db69c34d3704c96515d5b1e9.exe	28
PID 2052 wrote to memory of 2860	2052	54d1ea41db69c34d3704c96515d5b1e9.exe	28
PID 2860 wrote to memory of 2816	2860	54d1ea41db69c34d3704c96515d5b1e9.exe	29
PID 2860 wrote to memory of 2816	2860	54d1ea41db69c34d3704c96515d5b1e9.exe	29
PID 2860 wrote to memory of 2816	2860	54d1ea41db69c34d3704c96515d5b1e9.exe	29
PID 2860 wrote to memory of 2816	2860	54d1ea41db69c34d3704c96515d5b1e9.exe	29
PID 2860 wrote to memory of 1564	2860	54d1ea41db69c34d3704c96515d5b1e9.exe	30
PID 2860 wrote to memory of 1564	2860	54d1ea41db69c34d3704c96515d5b1e9.exe	30
PID 2860 wrote to memory of 1564	2860	54d1ea41db69c34d3704c96515d5b1e9.exe	30
PID 2860 wrote to memory of 1564	2860	54d1ea41db69c34d3704c96515d5b1e9.exe	30
PID 2816 wrote to memory of 1628	2816	cmd.exe	31
PID 2816 wrote to memory of 1628	2816	cmd.exe	31
PID 2816 wrote to memory of 1628	2816	cmd.exe	31
PID 2816 wrote to memory of 1628	2816	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\54d1ea41db69c34d3704c96515d5b1e9.exe
"C:\Users\Admin\AppData\Local\Temp\54d1ea41db69c34d3704c96515d5b1e9.exe"
1⤵
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Local\Temp\54d1ea41db69c34d3704c96515d5b1e9.exe
  C:\Users\Admin\AppData\Local\Temp\54d1ea41db69c34d3704c96515d5b1e9.exe
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\a.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\SysWOW64\regedit.exe
      REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
      4⤵
      Modifies security service
      Runs .reg file with regedit
      PID:1628
- - C:\Windows\SysWOW64\win.exe
    C:\Windows\system32\win.exe 480 "C:\Users\Admin\AppData\Local\Temp\54d1ea41db69c34d3704c96515d5b1e9.exe"
    3⤵
    - Executes dropped EXE
    - Maps connected drives based on registry
    PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
1KB

MD5
895301bce84d6fe707b5cfd50f1f9f97

SHA1
50a012f59655621768f624c4571654145663c042

SHA256
b2c6435e83784b85e7f4bdd4568bd954029caac9f5795e3111ae75db0f9874d4

SHA512
a75188afa7c01959bcbf7b832d92d0134072eecd3dd58d6179bc626024d4c9593cadc5cf9ab00deb3824853df003a0a73c84b60cefbdcb6944d216534ea7ffc4

Download Submit
\??\c:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
memory/2860-0-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2860-2-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2860-4-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2860-6-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2860-137-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2860-18-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2860-10-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2860-8-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads