c9aa075e5d22728c88a478e48ee29d1cabb5f40b2d9fd5e6c579478634068a64

General

Target

72391adb7673ffead450e6aa6ce7158d.exe
Size

620KB
MD5

72391adb7673ffead450e6aa6ce7158d
SHA1

416f616b7a38c28be345a187f18da55c5de45d04
SHA256

c9aa075e5d22728c88a478e48ee29d1cabb5f40b2d9fd5e6c579478634068a64
SHA512

8e7465264c0212a3279b61b74cf1f3d565b7907704ba2ebd6a600523d3f32d24007e812d455097654a4e52719c03e32f37c69dba0812766f52f055002acce6ec
SSDEEP

12288:QjsOWrncgLfHXZjHkOnmR8EzHXsLBOhocrZN:QjDq9fHXZjERRVzsOZr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
748	svchost.exe
4972	svchost.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dhcp\svchost.exe	72391adb7673ffead450e6aa6ce7158d.exe
File created	C:\Windows\dhcp\svchost.exe	72391adb7673ffead450e6aa6ce7158d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer\Navigating\.Current	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer\Navigating	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1601 = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\AppEvents\Schemes\Apps\Explorer	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4972	svchost.exe
4972	svchost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 748	2744	72391adb7673ffead450e6aa6ce7158d.exe	91
PID 2744 wrote to memory of 748	2744	72391adb7673ffead450e6aa6ce7158d.exe	91
PID 2744 wrote to memory of 748	2744	72391adb7673ffead450e6aa6ce7158d.exe	91
PID 2744 wrote to memory of 4744	2744	72391adb7673ffead450e6aa6ce7158d.exe	93
PID 2744 wrote to memory of 4744	2744	72391adb7673ffead450e6aa6ce7158d.exe	93
PID 2744 wrote to memory of 4744	2744	72391adb7673ffead450e6aa6ce7158d.exe	93

C:\Users\Admin\AppData\Local\Temp\72391adb7673ffead450e6aa6ce7158d.exe
"C:\Users\Admin\AppData\Local\Temp\72391adb7673ffead450e6aa6ce7158d.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Windows\dhcp\svchost.exe
  C:\Windows\dhcp\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\72391adb7673ffead450e6aa6ce7158d.bat
  2⤵
  PID:4744

C:\Windows\dhcp\svchost.exe
C:\Windows\dhcp\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\72391adb7673ffead450e6aa6ce7158d.bat

Filesize
196B

MD5
6d997ea48c593b2e4109631bb460aad4

SHA1
bf9135eb3883774d6bfe1046dafc86698fe6f4c8

SHA256
be4d07052f792f38cb9eb644924c6daf8dfe1aae21e469c5b14731738921debb

SHA512
109f7a3b0fc5c70419b8a544440f63af7ce8dc3dff5ffa3c16b985359e3794f1098deac3bd336ffe9a5c60946476cd41588ccb07557f887ffc21c66cd1691908

Download Submit
C:\Windows\dhcp\svchost.exe

Filesize
620KB

MD5
72391adb7673ffead450e6aa6ce7158d

SHA1
416f616b7a38c28be345a187f18da55c5de45d04

SHA256
c9aa075e5d22728c88a478e48ee29d1cabb5f40b2d9fd5e6c579478634068a64

SHA512
8e7465264c0212a3279b61b74cf1f3d565b7907704ba2ebd6a600523d3f32d24007e812d455097654a4e52719c03e32f37c69dba0812766f52f055002acce6ec

Download Submit
memory/748-6-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/748-11-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2744-0-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/2744-12-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4972-8-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download
memory/4972-14-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4972-16-0x0000000000F90000-0x0000000000F91000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing