8efdd75cbe81fcbeb47acf6082db087b668808f721aeaacc89d2b79efa4da971

General

Target

0a5bc0c4edebf59f51c43532a8695f7f.exe
Size

1.9MB
MD5

0a5bc0c4edebf59f51c43532a8695f7f
SHA1

346ccb61505d0c554997c5b767706a28393bbe69
SHA256

8efdd75cbe81fcbeb47acf6082db087b668808f721aeaacc89d2b79efa4da971
SHA512

9b18adf3d1d7f3100e153033f99728050f2188243d8aaf88f60abd9ed7ef02156d0267a9d5c1cdac7d45e6e3e2e3ea1a37b9054e2fb9f48f72f0bab096f4a9ba
SSDEEP

12288:RFfwcHcu8pMkZ3Fn9d+Vd3SUZ+7EeI1x7f7V3+hT6DaRWz58kc+1xy8SyGR4Z:RJcu8pl9d+VdCUhN1SsNK+1pSyA4Z

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	0a5bc0c4edebf59f51c43532a8695f7f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	services.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	0a5bc0c4edebf59f51c43532a8695f7f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	0a5bc0c4edebf59f51c43532a8695f7f.exe

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	0a5bc0c4edebf59f51c43532a8695f7f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	0a5bc0c4edebf59f51c43532a8695f7f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	services.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}	0a5bc0c4edebf59f51c43532a8695f7f.exe

Executes dropped EXE 2 IoCs

pid	Process
1524	fservice.exe
3184	services.exe

Loads dropped DLL 5 IoCs

pid	Process
3184	services.exe
3184	services.exe
3184	services.exe
1524	fservice.exe
808	0a5bc0c4edebf59f51c43532a8695f7f.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	0a5bc0c4edebf59f51c43532a8695f7f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	services.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fservice.exe	0a5bc0c4edebf59f51c43532a8695f7f.exe
File created	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\winkey.dll	services.exe
File created	C:\Windows\SysWOW64\reginv.dll	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	0a5bc0c4edebf59f51c43532a8695f7f.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\services.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	fservice.exe
File opened for modification	C:\Windows\system\sservice.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	services.exe
File created	C:\Windows\system\sservice.exe	0a5bc0c4edebf59f51c43532a8695f7f.exe
File opened for modification	C:\Windows\system\sservice.exe	0a5bc0c4edebf59f51c43532a8695f7f.exe
File created	C:\Windows\services.exe	fservice.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe
3184	services.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3184	services.exe
3184	services.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 808 wrote to memory of 1524	808	0a5bc0c4edebf59f51c43532a8695f7f.exe	33
PID 808 wrote to memory of 1524	808	0a5bc0c4edebf59f51c43532a8695f7f.exe	33
PID 808 wrote to memory of 1524	808	0a5bc0c4edebf59f51c43532a8695f7f.exe	33
PID 1524 wrote to memory of 3184	1524	fservice.exe	23
PID 1524 wrote to memory of 3184	1524	fservice.exe	23
PID 1524 wrote to memory of 3184	1524	fservice.exe	23
PID 3184 wrote to memory of 4596	3184	services.exe	24
PID 3184 wrote to memory of 4596	3184	services.exe	24
PID 3184 wrote to memory of 4596	3184	services.exe	24
PID 3184 wrote to memory of 4000	3184	services.exe	30
PID 3184 wrote to memory of 4000	3184	services.exe	30
PID 3184 wrote to memory of 4000	3184	services.exe	30
PID 4000 wrote to memory of 4360	4000	NET.exe	26
PID 4000 wrote to memory of 4360	4000	NET.exe	26
PID 4000 wrote to memory of 4360	4000	NET.exe	26
PID 4596 wrote to memory of 772	4596	NET.exe	27
PID 4596 wrote to memory of 772	4596	NET.exe	27
PID 4596 wrote to memory of 772	4596	NET.exe	27

C:\Users\Admin\AppData\Local\Temp\0a5bc0c4edebf59f51c43532a8695f7f.exe
"C:\Users\Admin\AppData\Local\Temp\0a5bc0c4edebf59f51c43532a8695f7f.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\SysWOW64\fservice.exe
  C:\Windows\system32\fservice.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1524

C:\Windows\services.exe
C:\Windows\services.exe -XP
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\SysWOW64\NET.exe
  NET STOP srservice
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 STOP srservice
    3⤵
    PID:772
- C:\Windows\SysWOW64\NET.exe
  NET STOP navapsvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP navapsvc
1⤵
PID:4360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

4

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\fservice.exe

Filesize
1.9MB

MD5
0a5bc0c4edebf59f51c43532a8695f7f

SHA1
346ccb61505d0c554997c5b767706a28393bbe69

SHA256
8efdd75cbe81fcbeb47acf6082db087b668808f721aeaacc89d2b79efa4da971

SHA512
9b18adf3d1d7f3100e153033f99728050f2188243d8aaf88f60abd9ed7ef02156d0267a9d5c1cdac7d45e6e3e2e3ea1a37b9054e2fb9f48f72f0bab096f4a9ba

Download Submit
C:\Windows\SysWOW64\fservice.exe

Filesize
1.9MB

MD5
31d36ca4b092f3f3c6957f19d8da3ee2

SHA1
8b3413511e3a37f8d53059f167cd607033565100

SHA256
b09956593687c4b9a150b1a96468c8125244f064adb44744c3b0cf1ee0afa7a9

SHA512
fdbc9a2f689f64f579275ca4d14bb2da519eba67d58b495242529817ff15601456c14ea8254841dccc8723a4a5e51f42a46935803ad3bd89b54c614fa0adaaed

Download Submit
C:\Windows\services.exe

Filesize
381KB

MD5
39fb84e9606cf2fd4081480f3f842a78

SHA1
2fe666e2427e407fb3e20d4cb8e58604f95ec6c7

SHA256
d9575b7f191c1d107ca3e52e408987a9cc6ef4d733f333235f6bd2d824ac3600

SHA512
44948d2a97fb96f71a0cf52d2384212f23ea07c23ecac74db74ec0dd9b7ad3fe54cd2169bad37ac348547e1612d5b5b70f3693748fa5166b78d7790caa2a54c3

Download Submit
C:\Windows\services.exe

Filesize
125KB

MD5
29988069e1ae2739bdc76a3b6ac3d33b

SHA1
c4e7ad20e5567529ff1c348788641c64abd88c73

SHA256
556bcc72f632a33f141907be3f30892313a5b0610067bfe0f2f2cd228e308ab5

SHA512
e8e5118d7d2470110958a546a8017e171532047d54df96a17e8b01da0120f7b0b2f44090405a8e6f9f872a8c49a1e60a9a568e09bf6fc0e7109d1310466b6496

Download Submit
memory/808-0-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/808-33-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/1524-8-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/1524-32-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-34-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-45-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-35-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/3184-17-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/3184-36-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-38-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/3184-39-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-41-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-43-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-22-0x0000000010000000-0x000000001000B000-memory.dmp

Filesize
44KB

Download
memory/3184-47-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-49-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-51-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-53-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-55-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-57-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-59-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download
memory/3184-61-0x0000000000400000-0x00000000005F8000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads