184105b25006155cdabe559105e29b900ce4e014346b34585e916d0229993b7b

General

Target
7acd929f1a629334a905f6c37e81f60a.exe
Size 240KB
Sample240107-y5vfpsefc7
SHA256 184105b25006155cdabe559105e29b900ce4e014346b34585e916d0229993b7b
MD5 7acd929f1a629334a905f6c37e81f60a
SHA1 5980d33ce5c046e3b9df5d6e2a59b2f76bab3a3c
SHA512 e67b33917ac8529dc92a36848b0f375fc5e37b39d4fa88305872b51db5e378472ada4fdde4691c55d6645045a0b0aea6a144fa9922a1291043cf74bdcab578af
SSDEEP 3072:4I0/tfqGL3txR6Nthj0I2aR1DXmaSU+ymHnHpgczwfSZJqsXSnhFkEv:Ut5xoNthj0I2aR1zmYiHvwfSZ4sXAF
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
4916	7acd929f1a629334a905f6c37e81f60a_3202.exe
260	7acd929f1a629334a905f6c37e81f60a_3202a.exe
2540	7acd929f1a629334a905f6c37e81f60a_3202b.exe
2012	BackgroundTransferHost.exe
4512	7acd929f1a629334a905f6c37e81f60a_3202d.exe
1420	7acd929f1a629334a905f6c37e81f60a_3202e.exe
3192	7acd929f1a629334a905f6c37e81f60a_3202f.exe

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\7acd929f1a629334a905f6c37e81f60a_3202a.exe\""	7acd929f1a629334a905f6c37e81f60a_3202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\7acd929f1a629334a905f6c37e81f60a_3202b.exe\""	7acd929f1a629334a905f6c37e81f60a_3202a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\7acd929f1a629334a905f6c37e81f60a_3202c.exe\""	7acd929f1a629334a905f6c37e81f60a_3202b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\7acd929f1a629334a905f6c37e81f60a_3202d.exe\""	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\7acd929f1a629334a905f6c37e81f60a_3202e.exe\""	7acd929f1a629334a905f6c37e81f60a_3202d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\7acd929f1a629334a905f6c37e81f60a_3202f.exe\""	7acd929f1a629334a905f6c37e81f60a_3202e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Trickler = "\"c:\\users\\admin\\appdata\\local\\temp\\7acd929f1a629334a905f6c37e81f60a_3202.exe\""	7acd929f1a629334a905f6c37e81f60a.exe

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	7acd929f1a629334a905f6c37e81f60a_3202.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	7acd929f1a629334a905f6c37e81f60a_3202a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 41d98bd126ca791e	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	7acd929f1a629334a905f6c37e81f60a.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	7acd929f1a629334a905f6c37e81f60a_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	7acd929f1a629334a905f6c37e81f60a_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 41d98bd126ca791e	7acd929f1a629334a905f6c37e81f60a.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	BackgroundTransferHost.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 41d98bd126ca791e	7acd929f1a629334a905f6c37e81f60a_3202d.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 41d98bd126ca791e	7acd929f1a629334a905f6c37e81f60a_3202e.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 41d98bd126ca791e	7acd929f1a629334a905f6c37e81f60a_3202.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 41d98bd126ca791e	7acd929f1a629334a905f6c37e81f60a_3202a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}\uets = 41d98bd126ca791e	7acd929f1a629334a905f6c37e81f60a_3202b.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\CLSID\{21FFB6C0-0DA1-11D5-A9D5-00500413153C}	7acd929f1a629334a905f6c37e81f60a_3202d.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4916	4496	7acd929f1a629334a905f6c37e81f60a.exe	31
PID 4496 wrote to memory of 4916	4496	7acd929f1a629334a905f6c37e81f60a.exe	31
PID 4496 wrote to memory of 4916	4496	7acd929f1a629334a905f6c37e81f60a.exe	31
PID 4916 wrote to memory of 260	4916	7acd929f1a629334a905f6c37e81f60a_3202.exe	30
PID 4916 wrote to memory of 260	4916	7acd929f1a629334a905f6c37e81f60a_3202.exe	30
PID 4916 wrote to memory of 260	4916	7acd929f1a629334a905f6c37e81f60a_3202.exe	30
PID 260 wrote to memory of 2540	260	7acd929f1a629334a905f6c37e81f60a_3202a.exe	29
PID 260 wrote to memory of 2540	260	7acd929f1a629334a905f6c37e81f60a_3202a.exe	29
PID 260 wrote to memory of 2540	260	7acd929f1a629334a905f6c37e81f60a_3202a.exe	29
PID 2540 wrote to memory of 2012	2540	7acd929f1a629334a905f6c37e81f60a_3202b.exe	127
PID 2540 wrote to memory of 2012	2540	7acd929f1a629334a905f6c37e81f60a_3202b.exe	127
PID 2540 wrote to memory of 2012	2540	7acd929f1a629334a905f6c37e81f60a_3202b.exe	127
PID 2012 wrote to memory of 4512	2012	BackgroundTransferHost.exe	27
PID 2012 wrote to memory of 4512	2012	BackgroundTransferHost.exe	27
PID 2012 wrote to memory of 4512	2012	BackgroundTransferHost.exe	27
PID 4512 wrote to memory of 1420	4512	7acd929f1a629334a905f6c37e81f60a_3202d.exe	26
PID 4512 wrote to memory of 1420	4512	7acd929f1a629334a905f6c37e81f60a_3202d.exe	26
PID 4512 wrote to memory of 1420	4512	7acd929f1a629334a905f6c37e81f60a_3202d.exe	26
PID 1420 wrote to memory of 3192	1420	7acd929f1a629334a905f6c37e81f60a_3202e.exe	22
PID 1420 wrote to memory of 3192	1420	7acd929f1a629334a905f6c37e81f60a_3202e.exe	22
PID 1420 wrote to memory of 3192	1420	7acd929f1a629334a905f6c37e81f60a_3202e.exe	22

C:\Users\Admin\AppData\Local\Temp\7acd929f1a629334a905f6c37e81f60a.exe
"C:\Users\Admin\AppData\Local\Temp\7acd929f1a629334a905f6c37e81f60a.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4496
- \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202.exe
  c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4916

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202g.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202g.exe
1⤵
PID:1908
- \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202h.exe
  c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202h.exe
  2⤵
  PID:448
- - \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202i.exe
    c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202i.exe
    3⤵
    PID:4740

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202f.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202f.exe
1⤵
- Executes dropped EXE
PID:3192

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202e.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202e.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1420

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202d.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202d.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4512

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202c.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202c.exe
1⤵
PID:2012

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202b.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202b.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2540

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202a.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202a.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:260

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202l.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202l.exe
1⤵
PID:688
- \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202m.exe
  c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202m.exe
  2⤵
  PID:4664

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202n.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202n.exe
1⤵
PID:4072
- \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202o.exe
  c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202o.exe
  2⤵
  PID:5080
- - \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202p.exe
    c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202p.exe
    3⤵
    PID:5036

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202q.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202q.exe
1⤵
PID:3020
- \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202r.exe
  c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202r.exe
  2⤵
  PID:3872

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202t.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202t.exe
1⤵
PID:4556
- \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202u.exe
  c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202u.exe
  2⤵
  PID:216
- - \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202v.exe
    c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202v.exe
    3⤵
    PID:4428

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202x.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202x.exe
1⤵
PID:548
- \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202y.exe
  c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202y.exe
  2⤵
  PID:5016

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202w.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202w.exe
1⤵
PID:1880

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202s.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202s.exe
1⤵
PID:2592

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202k.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202k.exe
1⤵
PID:4368

\??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202j.exe
c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202j.exe
1⤵
PID:1952

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7acd929f1a629334a905f6c37e81f60a_3202i.exe

Path C:\Users\Admin\AppData\Local\Temp\7acd929f1a629334a905f6c37e81f60a_3202i.exe
Size 96KB
SHA256 af46a65f705b85cb1e5d64bfcd0766136398bab191a6c1392eda05f15d090fd8
MD5 132924dc2b323cf34f0f0f6fe2b8b697
SHA1 d2ec748da74bd8010cc40b9a8b71c4940a92c17d
SHA512 989c39844128163b8ecdde82698d1301c1c5a4556c2622c34e5e87295051fede4ea0f184a49353765bc3797d405286b03078e672e9a97490e6b5c2fc862b6aae
SSDEEP 1536:+pIW/uCtfip065cL+zrMpLxR6bNjASD9hj0+nan+fMSb23LmR+Nb:4I0/tfqGL3txR6Nthj0I2aR2
MD5 SHA1 SHA512 SSDEEP

Submit Download

7acd929f1a629334a905f6c37e81f60a_3202j.exe

Path C:\Users\Admin\AppData\Local\Temp\7acd929f1a629334a905f6c37e81f60a_3202j.exe
Size 240KB
SHA256 d3a668f9ff0ceef07c90a2176f908bc1ee8934e561da2dbaa53089b7a798a7a2
MD5 c5560be32685ceb471a5bf8770015655
SHA1 16eab9c83bc2f5ab933809212971a0958e2831c4
SHA512 3ecb8388aa8e968f81375b0130382540bf1c98b06d27f47f40547b5dee0f7290e8114dfb8d921b13e09702d2196f72d0156581b0a4c118ac4654d1c488adc392
SSDEEP 3072:4I0/tfqGL3txR6Nthj0I2aR1DXmaSU+ymHnHpgczwfSZJqsXWnhFkEv:Ut5xoNthj0I2aR1zmYiHvwfSZ4sXUF
MD5 SHA1 SHA512 SSDEEP

Submit Download

7acd929f1a629334a905f6c37e81f60a_3202.exe

Path \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202.exe
Size 240KB
SHA256 5b871f14000aaf586935c87c20fbe0d224eae6735022326db6cbe374b1c14cb5
MD5 ec0e2d9c8d1e652d9e88ebace9223f31
SHA1 b4851c430da53c8d504fc6260f6d286035287123
SHA512 f5975ea8c2d0b5f421db0006b2dd8849bf7e5a7382d8ace218d9fafcad04434f4c8576e8dbfd3e58b7fbcda1febb5ccbfae3aa4f39c118962d0162ae1496f960
SSDEEP 3072:4I0/tfqGL3txR6Nthj0I2aR1DXmaSU+ymHnHpgczwfSZJqsX3nhFkEv:Ut5xoNthj0I2aR1zmYiHvwfSZ4sXxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

7acd929f1a629334a905f6c37e81f60a_3202d.exe

Path \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202d.exe
Size 240KB
SHA256 a24402f58f98e47577265c3febb82f1d4d51b52af13b2cc99d52ecc6b6dc60c9
MD5 fc62c120c54eb1afa2facb4f96a1b85e
SHA1 5a2a2071d3851750638f0b06a55e687161a9cc48
SHA512 a27f97a421c5ac298896aeb57b828fcf069cf6ef2301658d094a34691f1564f04d4990b07e017d55676dbd06bb2d45da2447f7dfe087aeb9a4a135871c7cc131
SSDEEP 3072:4I0/tfqGL3txR6Nthj0I2aR1DXmaSU+ymHnHpgczwfSZJqsX1nhFkEv:Ut5xoNthj0I2aR1zmYiHvwfSZ4sXbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

7acd929f1a629334a905f6c37e81f60a_3202i.exe

Path \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202i.exe
Size 94KB
SHA256 b20f5cb7300000776da0654d251689c2a05179a5b7c45a03e4d97801da0b4171
MD5 a9d00c356d42a374db9298bf6fa11890
SHA1 0168b3b6027aa8eb8b89078b457517e21802bdb6
SHA512 ac27e0cefb74b0a00fe6eb8d5f90279ef4ef5492fa76937b742e9bfbb2fbe136c0e0904188454d12504c4a9a5a60d3a5e2a639f1bfbde4550e3ff440a6990e05
SSDEEP 1536:+pIW/uCtfip065cL+zrMpLxR6bNjASD9hj0+nan+fMSb23LmR+9:4I0/tfqGL3txR6Nthj0I2aRy
MD5 SHA1 SHA512 SSDEEP

Submit Download

7acd929f1a629334a905f6c37e81f60a_3202k.exe

Path \??\c:\users\admin\appdata\local\temp\7acd929f1a629334a905f6c37e81f60a_3202k.exe
Size 92KB
SHA256 a5accdfab3811a52d3723a3380f30dec652f04785a20747fa6c7a5ebcd478c71
MD5 21bbef624348d0a9391864788c711072
SHA1 ff20831bdc733d97f8e975a98d8f0a971304f3e4
SHA512 f9ec75e9306847d41e9c5d560f8a4273fb11f25d99e204290714fe9017a1862ed50e9aeacb751269c96e2e466604abb21d26d9160a16b2d76afc639165925e73
SSDEEP 1536:+pIW/uCtfip065cL+zrMpLxR6bNjASD9hj0+nan+fMSb23LmR+d:4I0/tfqGL3txR6Nthj0I2aRC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads