50dc462a48b96113b0403ce43470a69e2e9eb6cfa0b358bc28481102e31435ab

General

Target

017bf1715955bf86ce50019701672081.exe
Size

1.2MB
MD5

017bf1715955bf86ce50019701672081
SHA1

3c7dd798ca577f706882ca705910e305d3cc570d
SHA256

50dc462a48b96113b0403ce43470a69e2e9eb6cfa0b358bc28481102e31435ab
SHA512

e67ca2e704e2a6e9b27133ea2a5d02222c979ec5c2fb8e9185905807b055578dbc6a9f734aa227858fe519b7f043d58ed7c066cea782e2461e60f050771746b4
SSDEEP

24576:N0bQMK/FmbOlk51dSJXsHu69FFEYLys8vQr2p49:ihjbOC1daXsO69h98lp49

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2780	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2700	33011715.exe

Loads dropped DLL 4 IoCs

pid	Process
2884	cmd.exe
2884	cmd.exe
2700	33011715.exe
2700	33011715.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\33011715 = "C:\\ProgramData\\33011715\\33011715.exe"	017bf1715955bf86ce50019701672081.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\33011715 = "C:\\PROGRA~3\\33011715\\33011715.exe"	33011715.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2784	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop	33011715.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Control Panel\Desktop\_Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg"	33011715.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2700	33011715.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2784	taskkill.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe
2700	33011715.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2780	2120	017bf1715955bf86ce50019701672081.exe	27
PID 2120 wrote to memory of 2780	2120	017bf1715955bf86ce50019701672081.exe	27
PID 2120 wrote to memory of 2780	2120	017bf1715955bf86ce50019701672081.exe	27
PID 2120 wrote to memory of 2780	2120	017bf1715955bf86ce50019701672081.exe	27
PID 2780 wrote to memory of 2784	2780	cmd.exe	29
PID 2780 wrote to memory of 2784	2780	cmd.exe	29
PID 2780 wrote to memory of 2784	2780	cmd.exe	29
PID 2780 wrote to memory of 2784	2780	cmd.exe	29
PID 2780 wrote to memory of 2884	2780	cmd.exe	31
PID 2780 wrote to memory of 2884	2780	cmd.exe	31
PID 2780 wrote to memory of 2884	2780	cmd.exe	31
PID 2780 wrote to memory of 2884	2780	cmd.exe	31
PID 2884 wrote to memory of 2700	2884	cmd.exe	32
PID 2884 wrote to memory of 2700	2884	cmd.exe	32
PID 2884 wrote to memory of 2700	2884	cmd.exe	32
PID 2884 wrote to memory of 2700	2884	cmd.exe	32

C:\Users\Admin\AppData\Local\Temp\017bf1715955bf86ce50019701672081.exe
"C:\Users\Admin\AppData\Local\Temp\017bf1715955bf86ce50019701672081.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\ProgramData\33011715\33011715.bat" "
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im 017bf1715955bf86ce50019701672081.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start C:\PROGRA~3\33011715\33011715.exe /install
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\PROGRA~3\33011715\33011715.exe
      C:\PROGRA~3\33011715\33011715.exe /install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Modifies Control Panel
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\33011715\33011715.bat

Filesize
290B

MD5
d35f9f7ef819fb75cd7ffa1cf1379d9a

SHA1
c9c8b9de4d1e4c46f717cbac262af9c94d609167

SHA256
b563b95e17e0e4d56969d2f03a45ad8b238b27da88701fafac04fcbbe29a13e7

SHA512
ef413ac2a1d0150fd232428d131ac003028000a306b1789f2430c52dba5e5a6d8411576b812e8a1e55af334b7609579ae5a10f9dbffb04e4f268bf71d9cab209

Download Submit
\PROGRA~3\33011715\33011715.exe

Filesize
1.2MB

MD5
017bf1715955bf86ce50019701672081

SHA1
3c7dd798ca577f706882ca705910e305d3cc570d

SHA256
50dc462a48b96113b0403ce43470a69e2e9eb6cfa0b358bc28481102e31435ab

SHA512
e67ca2e704e2a6e9b27133ea2a5d02222c979ec5c2fb8e9185905807b055578dbc6a9f734aa227858fe519b7f043d58ed7c066cea782e2461e60f050771746b4

Download Submit
memory/2120-1-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2120-2-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/2120-3-0x00000000001C0000-0x00000000001C2000-memory.dmp

Filesize
8KB

Download
memory/2120-4-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2120-7-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2120-15-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2120-17-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-29-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-39-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2700-26-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/2700-27-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-28-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-24-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-30-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-31-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2700-36-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-37-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-38-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-25-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2700-40-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-41-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-42-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-43-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-45-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-46-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-47-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-48-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-49-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download
memory/2700-50-0x0000000000400000-0x00000000005F7000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads