d5eb64a4299bc489d0e73aa95dd4bab67212169e1868137cba6654171f58f9fd

Analysis

max time kernel
146s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

193a2f1f586f5966a670c0cebdcd767a.exe
Size

510KB
MD5

193a2f1f586f5966a670c0cebdcd767a
SHA1

80747541e667065c5224e45858147b9491af5106
SHA256

d5eb64a4299bc489d0e73aa95dd4bab67212169e1868137cba6654171f58f9fd
SHA512

9e7f7e7b33fc5784be755874324344e45a05a85300c81f77ac881b9f526b436c847a8928e33d4ec2259d8c9e7254ac83fe24bd0405f37d4c3eaa3a2d6390f996
SSDEEP

12288:qsMxi+i/NBzYLJpjJICcfkmOjuXCjhpehUNtTird:qsMxwNBkOf6jyIehETEd

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	193a2f1f586f5966a670c0cebdcd767a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\fservice.exe"	services.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	193a2f1f586f5966a670c0cebdcd767a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	193a2f1f586f5966a670c0cebdcd767a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\DirectX For Microsoft® Windows = "C:\\Windows\\system32\\fservice.exe"	services.exe

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}	193a2f1f586f5966a670c0cebdcd767a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	193a2f1f586f5966a670c0cebdcd767a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	193a2f1f586f5966a670c0cebdcd767a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5Y99AE78-58TT-11dW-BE53-Y67078979Y}\StubPath = "C:\\Windows\\system\\sservice.exe"	services.exe

Executes dropped EXE 2 IoCs

pid	Process
4368	fservice.exe
1856	services.exe

Loads dropped DLL 5 IoCs

pid	Process
1856	services.exe
1856	services.exe
1856	services.exe
4368	fservice.exe
3448	193a2f1f586f5966a670c0cebdcd767a.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	193a2f1f586f5966a670c0cebdcd767a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	services.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	fservice.exe
File created	C:\Windows\SysWOW64\winkey.dll	services.exe
File created	C:\Windows\SysWOW64\reginv.dll	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	services.exe
File created	C:\Windows\SysWOW64\fservice.exe	193a2f1f586f5966a670c0cebdcd767a.exe
File opened for modification	C:\Windows\SysWOW64\fservice.exe	193a2f1f586f5966a670c0cebdcd767a.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	fservice.exe
File opened for modification	C:\Windows\services.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	fservice.exe
File opened for modification	C:\Windows\system\sservice.exe	fservice.exe
File created	C:\Windows\system\sservice.exe	services.exe
File created	C:\Windows\system\sservice.exe	193a2f1f586f5966a670c0cebdcd767a.exe
File opened for modification	C:\Windows\system\sservice.exe	193a2f1f586f5966a670c0cebdcd767a.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe
1856	services.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1856	services.exe
1856	services.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 4368	3448	193a2f1f586f5966a670c0cebdcd767a.exe	28
PID 3448 wrote to memory of 4368	3448	193a2f1f586f5966a670c0cebdcd767a.exe	28
PID 3448 wrote to memory of 4368	3448	193a2f1f586f5966a670c0cebdcd767a.exe	28
PID 4368 wrote to memory of 1856	4368	fservice.exe	27
PID 4368 wrote to memory of 1856	4368	fservice.exe	27
PID 4368 wrote to memory of 1856	4368	fservice.exe	27
PID 1856 wrote to memory of 2172	1856	services.exe	26
PID 1856 wrote to memory of 2172	1856	services.exe	26
PID 1856 wrote to memory of 2172	1856	services.exe	26
PID 1856 wrote to memory of 968	1856	services.exe	25
PID 1856 wrote to memory of 968	1856	services.exe	25
PID 1856 wrote to memory of 968	1856	services.exe	25
PID 968 wrote to memory of 4276	968	NET.exe	23
PID 968 wrote to memory of 4276	968	NET.exe	23
PID 968 wrote to memory of 4276	968	NET.exe	23
PID 2172 wrote to memory of 4856	2172	NET.exe	21
PID 2172 wrote to memory of 4856	2172	NET.exe	21
PID 2172 wrote to memory of 4856	2172	NET.exe	21

C:\Users\Admin\AppData\Local\Temp\193a2f1f586f5966a670c0cebdcd767a.exe
"C:\Users\Admin\AppData\Local\Temp\193a2f1f586f5966a670c0cebdcd767a.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\SysWOW64\fservice.exe
  C:\Windows\system32\fservice.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4368

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP srservice
1⤵
PID:4856

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 STOP navapsvc
1⤵
PID:4276

C:\Windows\SysWOW64\NET.exe
NET STOP navapsvc
1⤵
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\NET.exe
NET STOP srservice
1⤵
- Suspicious use of WriteProcessMemory
PID:2172

C:\Windows\services.exe
C:\Windows\services.exe -XP
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-185-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-195-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-197-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-199-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-219-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-217-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-215-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-213-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-211-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-209-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-207-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-205-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-203-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/1856-201-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3448-30-0x00000000028D0000-0x00000000028D1000-memory.dmp

Filesize
4KB

Download
memory/3448-23-0x0000000002740000-0x0000000002741000-memory.dmp

Filesize
4KB

Download
memory/3448-60-0x0000000002F10000-0x0000000002F11000-memory.dmp

Filesize
4KB

Download
memory/3448-59-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Filesize
4KB

Download
memory/3448-58-0x0000000002EF0000-0x0000000002EF1000-memory.dmp

Filesize
4KB

Download
memory/3448-57-0x0000000002EC0000-0x0000000002EC1000-memory.dmp

Filesize
4KB

Download
memory/3448-56-0x0000000002ED0000-0x0000000002ED1000-memory.dmp

Filesize
4KB

Download
memory/3448-55-0x0000000002EA0000-0x0000000002EA1000-memory.dmp

Filesize
4KB

Download
memory/3448-54-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Filesize
4KB

Download
memory/3448-48-0x0000000002B20000-0x0000000002B21000-memory.dmp

Filesize
4KB

Download
memory/3448-47-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/3448-46-0x0000000002B10000-0x0000000002B11000-memory.dmp

Filesize
4KB

Download
memory/3448-45-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download
memory/3448-44-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/3448-43-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/3448-42-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download
memory/3448-41-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/3448-40-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/3448-39-0x0000000002940000-0x0000000002941000-memory.dmp

Filesize
4KB

Download
memory/3448-38-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/3448-37-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/3448-36-0x0000000002930000-0x0000000002931000-memory.dmp

Filesize
4KB

Download
memory/3448-35-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/3448-34-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/3448-33-0x00000000028E0000-0x00000000028E1000-memory.dmp

Filesize
4KB

Download
memory/3448-32-0x00000000028F0000-0x00000000028F1000-memory.dmp

Filesize
4KB

Download
memory/3448-62-0x0000000002F30000-0x0000000002F31000-memory.dmp

Filesize
4KB

Download
memory/3448-29-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/3448-28-0x00000000028B0000-0x00000000028B1000-memory.dmp

Filesize
4KB

Download
memory/3448-27-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download
memory/3448-26-0x0000000002890000-0x0000000002891000-memory.dmp

Filesize
4KB

Download
memory/3448-25-0x0000000002860000-0x0000000002861000-memory.dmp

Filesize
4KB

Download
memory/3448-24-0x0000000002870000-0x0000000002871000-memory.dmp

Filesize
4KB

Download
memory/3448-61-0x0000000002F00000-0x0000000002F01000-memory.dmp

Filesize
4KB

Download
memory/3448-22-0x0000000002750000-0x0000000002751000-memory.dmp

Filesize
4KB

Download
memory/3448-21-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/3448-20-0x0000000002730000-0x0000000002731000-memory.dmp

Filesize
4KB

Download
memory/3448-19-0x00000000026F0000-0x00000000026F1000-memory.dmp

Filesize
4KB

Download
memory/3448-18-0x0000000002700000-0x0000000002701000-memory.dmp

Filesize
4KB

Download
memory/3448-17-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/3448-16-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/3448-15-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/3448-14-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/3448-13-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/3448-12-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/3448-11-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3448-10-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/3448-9-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/3448-8-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/3448-6-0x0000000002640000-0x0000000002643000-memory.dmp

Filesize
12KB

Download
memory/3448-7-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/3448-64-0x0000000002F20000-0x0000000002F21000-memory.dmp

Filesize
4KB

Download
memory/3448-67-0x0000000002F50000-0x0000000002F51000-memory.dmp

Filesize
4KB

Download
memory/3448-69-0x0000000002F70000-0x0000000002F71000-memory.dmp

Filesize
4KB

Download
memory/3448-163-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3448-70-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/3448-68-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/3448-49-0x0000000002B00000-0x0000000002B01000-memory.dmp

Filesize
4KB

Download
memory/3448-31-0x00000000028C0000-0x00000000028C1000-memory.dmp

Filesize
4KB

Download
memory/3448-3-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/3448-0-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/3448-5-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/3448-4-0x0000000000C20000-0x0000000000C21000-memory.dmp

Filesize
4KB

Download
memory/3448-2-0x0000000000C30000-0x0000000000C73000-memory.dmp

Filesize
268KB

Download
memory/3448-1-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download
memory/4368-157-0x0000000000400000-0x000000000061D000-memory.dmp

Filesize
2.1MB

Download