952317229d1e77340b65639145073369a7e1a0a38718e05819c9c4791ecd5534

General

Target

18d1a10285383dbf8a2343e4b9c1fc3c.exe
Size

2.0MB
MD5

18d1a10285383dbf8a2343e4b9c1fc3c
SHA1

e0a53fa4e9f303e87dfe612a9495290ea27e21d3
SHA256

952317229d1e77340b65639145073369a7e1a0a38718e05819c9c4791ecd5534
SHA512

d3000f6115555a836661617e36c5af4bc61acfdff5b51b94136b8497de3a2b8d4b449dc1307726f434774500e960ae6f0f0c5bda94a041ca384f17cfbd32da46
SSDEEP

49152:MvVl3ySej9XajZGssKdpH/AoBbuejcxh7ZOGx74fp:a3CSekIT+AUNjMFZOGx70

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk	4tK193Ap.exe

Executes dropped EXE 2 IoCs

pid	Process
3168	gO8uT51.exe
2996	4tK193Ap.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe"	4tK193Ap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	18d1a10285383dbf8a2343e4b9c1fc3c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	gO8uT51.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe
2996	4tK193Ap.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
952	schtasks.exe
832	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	4tK193Ap.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2996	4tK193Ap.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 3168	4848	18d1a10285383dbf8a2343e4b9c1fc3c.exe	87
PID 4848 wrote to memory of 3168	4848	18d1a10285383dbf8a2343e4b9c1fc3c.exe	87
PID 4848 wrote to memory of 3168	4848	18d1a10285383dbf8a2343e4b9c1fc3c.exe	87
PID 3168 wrote to memory of 2996	3168	gO8uT51.exe	88
PID 3168 wrote to memory of 2996	3168	gO8uT51.exe	88
PID 3168 wrote to memory of 2996	3168	gO8uT51.exe	88
PID 2996 wrote to memory of 4804	2996	4tK193Ap.exe	92
PID 2996 wrote to memory of 4804	2996	4tK193Ap.exe	92
PID 2996 wrote to memory of 4804	2996	4tK193Ap.exe	92
PID 4804 wrote to memory of 952	4804	cmd.exe	94
PID 4804 wrote to memory of 952	4804	cmd.exe	94
PID 4804 wrote to memory of 952	4804	cmd.exe	94
PID 2996 wrote to memory of 4160	2996	4tK193Ap.exe	96
PID 2996 wrote to memory of 4160	2996	4tK193Ap.exe	96
PID 2996 wrote to memory of 4160	2996	4tK193Ap.exe	96
PID 4160 wrote to memory of 832	4160	cmd.exe	97
PID 4160 wrote to memory of 832	4160	cmd.exe	97
PID 4160 wrote to memory of 832	4160	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\18d1a10285383dbf8a2343e4b9c1fc3c.exe
"C:\Users\Admin\AppData\Local\Temp\18d1a10285383dbf8a2343e4b9c1fc3c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gO8uT51.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gO8uT51.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4tK193Ap.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4tK193Ap.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2996
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4804
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:952
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
        5⤵
        Creates scheduled task(s)
        
        PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\gO8uT51.exe

Filesize
1.9MB

MD5
b316244d46d5c6c7fb9ff8e11f147f48

SHA1
cda202da3c4957dace154bf838b929f88ab3c2c0

SHA256
536a44bb2eafbc19194bda958b07381438e55bc676feedb631c2a8d00025bbd8

SHA512
2e421bca838d17c7196fb3443b6099baf36d838019060f49d78299347d48d0f573cda264f19ad75ced3f092ca75ffba1fbc61f3044f43aea7296bea83d13cfcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\4tK193Ap.exe

Filesize
1.5MB

MD5
c2111e61e7ba399ef043c265c4215de2

SHA1
a7c1289cf1e2ae758d8c1ef409a9b4b8a468da1a

SHA256
606bc55fad2b4b1ec117c8df11571f153ac95736e6fcfa8dd8874d88eaa1a48b

SHA512
9f972eb5a7725507cef4d8a597d2872466a0883ef58d3c2cf1f5e59379129e9531978c73d1cf07ad47d7877f874af8486e182778b1d3acfbebba60bfb21509de

Download Submit
memory/2996-14-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-15-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-16-0x0000000008F30000-0x0000000008FA6000-memory.dmp

Filesize
472KB

Download
memory/2996-24-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-25-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-26-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-27-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-28-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-30-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-31-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-32-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-33-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-34-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-35-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-36-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-37-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download
memory/2996-38-0x0000000000CF0000-0x000000000114E000-memory.dmp

Filesize
4.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads