1002b595d5153ea888a23b3d5253105fb8e30d94bf9bfc4544f8094a1d849948

General

Target

573449aee41dada8315245de9c17f96d.exe
Size

3.1MB
MD5

573449aee41dada8315245de9c17f96d
SHA1

3f134e9e4df7146c6e572069f5d6623d5dc7d200
SHA256

1002b595d5153ea888a23b3d5253105fb8e30d94bf9bfc4544f8094a1d849948
SHA512

4f30ba1b60dd7a82eccbe443fe0049e4b360d27ea518f3a0a61a7e2a7a5bd967c58739cb165a16fb0e3e129718b9afae78f3fc0a063a2ec4a874d410ab3947ec
SSDEEP

98304:QEmhtXP+pTDCrmHZ9Gy7dWHQJIuULiVzxDXwZjUEDYZT+UVim4e:UaTG6HzfznbCfDAVite

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
2900	netsh.exe

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Uses Session Manager for persistence 2 TTPs 3 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SESSION MANAGER\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	reg.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows32 = "C:\\windows\\system\\win.exe"	573449aee41dada8315245de9c17f96d.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\reg_0001.txt	573449aee41dada8315245de9c17f96d.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\windows\system\win.exe	573449aee41dada8315245de9c17f96d.exe
File opened for modification	C:\windows\system\win.exe	573449aee41dada8315245de9c17f96d.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2764	sc.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2732	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2512	573449aee41dada8315245de9c17f96d.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 2732	2512	573449aee41dada8315245de9c17f96d.exe	27
PID 2512 wrote to memory of 2732	2512	573449aee41dada8315245de9c17f96d.exe	27
PID 2512 wrote to memory of 2732	2512	573449aee41dada8315245de9c17f96d.exe	27
PID 2512 wrote to memory of 2732	2512	573449aee41dada8315245de9c17f96d.exe	27
PID 2512 wrote to memory of 2764	2512	573449aee41dada8315245de9c17f96d.exe	28
PID 2512 wrote to memory of 2764	2512	573449aee41dada8315245de9c17f96d.exe	28
PID 2512 wrote to memory of 2764	2512	573449aee41dada8315245de9c17f96d.exe	28
PID 2512 wrote to memory of 2764	2512	573449aee41dada8315245de9c17f96d.exe	28
PID 2512 wrote to memory of 2904	2512	573449aee41dada8315245de9c17f96d.exe	30
PID 2512 wrote to memory of 2904	2512	573449aee41dada8315245de9c17f96d.exe	30
PID 2512 wrote to memory of 2904	2512	573449aee41dada8315245de9c17f96d.exe	30
PID 2512 wrote to memory of 2904	2512	573449aee41dada8315245de9c17f96d.exe	30
PID 2512 wrote to memory of 2944	2512	573449aee41dada8315245de9c17f96d.exe	32
PID 2512 wrote to memory of 2944	2512	573449aee41dada8315245de9c17f96d.exe	32
PID 2512 wrote to memory of 2944	2512	573449aee41dada8315245de9c17f96d.exe	32
PID 2512 wrote to memory of 2944	2512	573449aee41dada8315245de9c17f96d.exe	32
PID 2512 wrote to memory of 3060	2512	573449aee41dada8315245de9c17f96d.exe	33
PID 2512 wrote to memory of 3060	2512	573449aee41dada8315245de9c17f96d.exe	33
PID 2512 wrote to memory of 3060	2512	573449aee41dada8315245de9c17f96d.exe	33
PID 2512 wrote to memory of 3060	2512	573449aee41dada8315245de9c17f96d.exe	33
PID 2512 wrote to memory of 2900	2512	573449aee41dada8315245de9c17f96d.exe	37
PID 2512 wrote to memory of 2900	2512	573449aee41dada8315245de9c17f96d.exe	37
PID 2512 wrote to memory of 2900	2512	573449aee41dada8315245de9c17f96d.exe	37
PID 2512 wrote to memory of 2900	2512	573449aee41dada8315245de9c17f96d.exe	37

C:\Users\Admin\AppData\Local\Temp\573449aee41dada8315245de9c17f96d.exe
"C:\Users\Admin\AppData\Local\Temp\573449aee41dada8315245de9c17f96d.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /create /tn startt /tr c:\autoexec.bat /sc onstart /ru system
  2⤵
  - Creates scheduled task(s)
  PID:2732
- C:\Windows\SysWOW64\sc.exe
  sc delete GbpSv
  2⤵
  - Launches sc.exe
  PID:2764
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\ControlSet001\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:2904
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\ControlSet002\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:2944
- C:\Windows\SysWOW64\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session manager" /v BootExecute /t REG_MULTI_SZ /d "autocheck autochk *" /f
  2⤵
  - Uses Session Manager for persistence
  PID:3060
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram C:\windows\system\win.exe RPCCC
  2⤵
  - Modifies Windows Firewall
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Create or Modify System Process

2

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Create or Modify System Process

2

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2512-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2512-0-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-4-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-5-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-6-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-7-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2512-8-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-9-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-10-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-11-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-12-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-13-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-14-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-15-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-16-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-17-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-18-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download
memory/2512-19-0x0000000000400000-0x0000000000DAD000-memory.dmp

Filesize
9.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads