7fbde55aebcbb096dd62041cdd5d08fcfd5777fc2ccefc35eb071ef27573e123

General

Target

459917e891be89478c96c6a2f3ba8c60.exe
Size

633KB
MD5

459917e891be89478c96c6a2f3ba8c60
SHA1

e480cfc229e89d2ace912c6529a61d54b272066c
SHA256

7fbde55aebcbb096dd62041cdd5d08fcfd5777fc2ccefc35eb071ef27573e123
SHA512

4fd7c8ba5ca55636a6782fc074cccac3f4134464cac0ea9d0fa66f48f9ff4cb47f9e03d29a37c5b56ae2ef69a5c660c1022795972bb27d2caba32671916cfaee
SSDEEP

12288:yhC6c2p68zXGZXmVIPRdu5mcHdF3Z4mxxP/zll/EpM/MlCD:yhC6ciepdul9QmX3zkA

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2588	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2716	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	svchost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.bat	459917e891be89478c96c6a2f3ba8c60.exe
File created	C:\Windows\svchost.exe	459917e891be89478c96c6a2f3ba8c60.exe
File opened for modification	C:\Windows\svchost.exe	459917e891be89478c96c6a2f3ba8c60.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B820964A-F0D0-4F41-8357-D62330221BA8}\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B820964A-F0D0-4F41-8357-D62330221BA8}\56-7d-4e-ce-ec-37	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-7d-4e-ce-ec-37\WpadDecisionTime = 4036615b6f40da01	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B820964A-F0D0-4F41-8357-D62330221BA8}	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B820964A-F0D0-4F41-8357-D62330221BA8}\WpadDecisionReason = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B820964A-F0D0-4F41-8357-D62330221BA8}\WpadNetworkName = "Network 3"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-7d-4e-ce-ec-37\WpadDecisionReason = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-7d-4e-ce-ec-37\WpadDecision = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00bb000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B820964A-F0D0-4F41-8357-D62330221BA8}\WpadDecisionTime = 4036615b6f40da01	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-7d-4e-ce-ec-37	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	459917e891be89478c96c6a2f3ba8c60.exe
Token: SeDebugPrivilege	2716	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2716	svchost.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2572	2716	svchost.exe	29
PID 2716 wrote to memory of 2572	2716	svchost.exe	29
PID 2716 wrote to memory of 2572	2716	svchost.exe	29
PID 2716 wrote to memory of 2572	2716	svchost.exe	29
PID 2412 wrote to memory of 2588	2412	459917e891be89478c96c6a2f3ba8c60.exe	30
PID 2412 wrote to memory of 2588	2412	459917e891be89478c96c6a2f3ba8c60.exe	30
PID 2412 wrote to memory of 2588	2412	459917e891be89478c96c6a2f3ba8c60.exe	30
PID 2412 wrote to memory of 2588	2412	459917e891be89478c96c6a2f3ba8c60.exe	30
PID 2412 wrote to memory of 2588	2412	459917e891be89478c96c6a2f3ba8c60.exe	30
PID 2412 wrote to memory of 2588	2412	459917e891be89478c96c6a2f3ba8c60.exe	30
PID 2412 wrote to memory of 2588	2412	459917e891be89478c96c6a2f3ba8c60.exe	30

C:\Users\Admin\AppData\Local\Temp\459917e891be89478c96c6a2f3ba8c60.exe
"C:\Users\Admin\AppData\Local\Temp\459917e891be89478c96c6a2f3ba8c60.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  PID:2588

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files\Internet Explorer\IexplOrE.ExE
  "C:\Program Files\Internet Explorer\IexplOrE.ExE"
  2⤵
  PID:2572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svchost.exe

Filesize
633KB

MD5
459917e891be89478c96c6a2f3ba8c60

SHA1
e480cfc229e89d2ace912c6529a61d54b272066c

SHA256
7fbde55aebcbb096dd62041cdd5d08fcfd5777fc2ccefc35eb071ef27573e123

SHA512
4fd7c8ba5ca55636a6782fc074cccac3f4134464cac0ea9d0fa66f48f9ff4cb47f9e03d29a37c5b56ae2ef69a5c660c1022795972bb27d2caba32671916cfaee

Download Submit
C:\Windows\uninstal.bat

Filesize
190B

MD5
b8cf0c8f7dba670d1d48eaf685c45f43

SHA1
b7d2ebc99188d18b4f3758ea2b7bba1f24c2ad07

SHA256
359469f116ea279abf6a03064e8822e3665e94548ecf8039f52017337491f9bf

SHA512
c0383381c8488b4cce8b13af9b4bf2aabeb671bea935fd5122ab8262d7c0320445131e8c4e7ff153a5742c6872789f46bcea6b00bcfaaa0a3ae84c351c7628e3

Download Submit
memory/2412-2-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/2412-7-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2412-8-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/2412-1-0x00000000002D0000-0x0000000000324000-memory.dmp

Filesize
336KB

Download
memory/2412-16-0x00000000032A0000-0x00000000032A1000-memory.dmp

Filesize
4KB

Download
memory/2412-4-0x0000000002300000-0x0000000002301000-memory.dmp

Filesize
4KB

Download
memory/2412-15-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2412-19-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/2412-18-0x0000000003280000-0x0000000003281000-memory.dmp

Filesize
4KB

Download
memory/2412-17-0x0000000003290000-0x0000000003291000-memory.dmp

Filesize
4KB

Download
memory/2412-13-0x0000000003360000-0x0000000003361000-memory.dmp

Filesize
4KB

Download
memory/2412-12-0x0000000003260000-0x0000000003263000-memory.dmp

Filesize
12KB

Download
memory/2412-11-0x0000000003270000-0x0000000003271000-memory.dmp

Filesize
4KB

Download
memory/2412-9-0x0000000002310000-0x0000000002311000-memory.dmp

Filesize
4KB

Download
memory/2412-10-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/2412-6-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2412-0-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/2412-3-0x0000000001E80000-0x0000000001E81000-memory.dmp

Filesize
4KB

Download
memory/2412-14-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2412-39-0x00000000002D0000-0x0000000000324000-memory.dmp

Filesize
336KB

Download
memory/2412-38-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/2412-5-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download
memory/2716-29-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2716-26-0x0000000003180000-0x0000000003181000-memory.dmp

Filesize
4KB

Download
memory/2716-25-0x0000000003150000-0x0000000003151000-memory.dmp

Filesize
4KB

Download
memory/2716-23-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download
memory/2716-28-0x0000000003160000-0x0000000003161000-memory.dmp

Filesize
4KB

Download
memory/2716-27-0x0000000003170000-0x0000000003171000-memory.dmp

Filesize
4KB

Download
memory/2716-24-0x0000000003140000-0x0000000003141000-memory.dmp

Filesize
4KB

Download
memory/2716-43-0x0000000003140000-0x0000000003141000-memory.dmp

Filesize
4KB

Download
memory/2716-42-0x0000000000350000-0x00000000003A4000-memory.dmp

Filesize
336KB

Download
memory/2716-41-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/2716-45-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2716-48-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download
memory/2716-52-0x0000000000400000-0x000000000051C000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing