9a5b1d0b07b40ec0cc2df2c47790ae49a6d85c009a57a73f20a4c830cefce2df

General

Target

003968f5.exe
Size

156KB
MD5

3a1f9e592937513387c9c1880f795757
SHA1

421b648186fb7be8e35c752f0aebf49aa0b702cb
SHA256

90922294e0c48386680d8bd3aa24f571746f2413c401c8b5e40a10e5dac859f2
SHA512

76a7693e5aaaabc25b1a9b036400617feeed5942cdae7fba9a8f5cccec22ab53140bd25f5f8e1a943a77dd49a02a49d03e4f3a62ae01e2d69b4be94185be5866
SSDEEP

3072:Z612XVqqVIAlGDInCOx7EVgeLCStSrsfp4ZdWh9NRI+JcMb8tyvl9RXECagIQCs7:I1MTZNiLCSSrc4ZdWh9tqit9WgFTDN1h

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

2616 cmd.exe
Executes dropped EXE 2 IoCs

Processes:

Explorer.EXEservices.exe

pid process

1360 Explorer.EXE
480 services.exe

pid	process
2616	cmd.exe

pid	process
1360	Explorer.EXE
480	services.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

003968f5.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	003968f5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	003968f5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{db46509d-5d12-1bd0-d886-080973d781e7}\\n."	003968f5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32\ = "\\\\.\\globalroot\\systemroot\\Installer\\{db46509d-5d12-1bd0-d886-080973d781e7}\\n."	003968f5.exe

Unexpected DNS network traffic destination 9 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234
Destination IP	66.85.130.234

Suspicious use of SetThreadContext 1 IoCs

Processes:

003968f5.exe

description pid process target process

PID 2376 set thread context of 2616 2376 003968f5.exe cmd.exe

description	pid	process	target process
PID 2376 set thread context of 2616	2376	003968f5.exe	cmd.exe

Drops file in Windows directory 2 IoCs

Processes:

003968f5.exe

description	ioc	process
File created	C:\Windows\Installer\{db46509d-5d12-1bd0-d886-080973d781e7}\n	003968f5.exe
File created	C:\Windows\Installer\{db46509d-5d12-1bd0-d886-080973d781e7}\@	003968f5.exe

Modifies registry class 6 IoCs

Processes:

003968f5.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\clsid	003968f5.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}	003968f5.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32	003968f5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ThreadingModel = "Both"	003968f5.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\{db46509d-5d12-1bd0-d886-080973d781e7}\\n."	003968f5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InprocServer32\ = "\\\\.\\globalroot\\systemroot\\Installer\\{db46509d-5d12-1bd0-d886-080973d781e7}\\n."	003968f5.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

003968f5.exe

pid process

2376 003968f5.exe
2376 003968f5.exe
2376 003968f5.exe
2376 003968f5.exe
2376 003968f5.exe
2376 003968f5.exe

pid	process
2376	003968f5.exe
2376	003968f5.exe
2376	003968f5.exe
2376	003968f5.exe
2376	003968f5.exe
2376	003968f5.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

003968f5.exeservices.exe

description	pid	process
Token: SeDebugPrivilege	2376	003968f5.exe
Token: SeDebugPrivilege	2376	003968f5.exe
Token: SeDebugPrivilege	2376	003968f5.exe
Token: SeBackupPrivilege	480	services.exe
Token: SeRestorePrivilege	480	services.exe
Token: SeSecurityPrivilege	480	services.exe
Token: SeTakeOwnershipPrivilege	480	services.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Explorer.EXE

pid process

1360 Explorer.EXE
1360 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1360 Explorer.EXE
1360 Explorer.EXE

pid	process
1360	Explorer.EXE
1360	Explorer.EXE

pid	process
1360	Explorer.EXE
1360	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

003968f5.exe

description	pid	process	target process
PID 2376 wrote to memory of 1360	2376	003968f5.exe	Explorer.EXE
PID 2376 wrote to memory of 1360	2376	003968f5.exe	Explorer.EXE
PID 2376 wrote to memory of 480	2376	003968f5.exe	services.exe
PID 2376 wrote to memory of 2616	2376	003968f5.exe	cmd.exe
PID 2376 wrote to memory of 2616	2376	003968f5.exe	cmd.exe
PID 2376 wrote to memory of 2616	2376	003968f5.exe	cmd.exe
PID 2376 wrote to memory of 2616	2376	003968f5.exe	cmd.exe
PID 2376 wrote to memory of 2616	2376	003968f5.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\003968f5.exe
"C:\Users\Admin\AppData\Local\Temp\003968f5.exe"
1⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Deletes itself
PID:2616

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1360

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:480

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\{db46509d-5d12-1bd0-d886-080973d781e7}\n
Filesize
26KB

MD5
fab7de9eafea67f88e43003698024c86

SHA1
24a4ef27c29cdeabed5e0af867e3f568da40d0c9

SHA256
073b1f99871dc56a33dcd55af71d53482816bfc9b3ce5c78ee53bed31b428384

SHA512
b4a57a8cc564760526d4cce26ce24e80657c064df373c307bb90cf053d01d04bdfe1def41fedfeb7715e53d8481a98c94bc6f3bf33815b4571d898aa08553fcd

Download Submit
\systemroot\Installer\{db46509d-5d12-1bd0-d886-080973d781e7}\@
Filesize
2KB

MD5
54582cce0ec87501bf258884c07a5022

SHA1
f508cb0ac8757bcd20b7451e83d1813ad177c8ba

SHA256
16b4d51912ccc80312308d01892b2dba0a3319eeb1a9b9f72a9604fb7692f0dc

SHA512
664ec2123286a0acc3a85f928b1c5ba1a08f027d03336f9d7be61cfb0a00f16eb9a580e48f051d0ec5b34142c48da28f84df5e0d1e766aa8f62484f6235f09f7

Download Submit
memory/480-12-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/480-18-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1360-3-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2376-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2376-2-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2376-14-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2376-15-0x00000000005C0000-0x00000000006C0000-memory.dmp

Filesize
1024KB

Download
memory/2376-17-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads