942a4b8b89e8363c9546971d2d8f8573efc39ed8d672200e4565a3b84f690151

General

Target

661cf7862181fdb9ae19c598a448297d.exe
Size

860KB
MD5

661cf7862181fdb9ae19c598a448297d
SHA1

a2da5641be4aa32d77856939c2648edfc857cc7d
SHA256

942a4b8b89e8363c9546971d2d8f8573efc39ed8d672200e4565a3b84f690151
SHA512

fd3db6720b95a1b56a6ea548e6d407e0058d6030d601c43f7c1045a4e741a77cb0ec58bc2b17221ddd85fbd75a31f880d9049bd0afed76b5a08bc6e125db78db
SSDEEP

24576:T+7P8h5/KgwSDqXsAJwB2W77ao4qdxBIjyiq3rd:+8h5/QqmjJwLTfBoRo

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2364	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1988	46218627.exe

Loads dropped DLL 5 IoCs

pid	Process
2348	cmd.exe
2348	cmd.exe
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\46218627 = "C:\\ProgramData\\46218627\\46218627.exe"	661cf7862181fdb9ae19c598a448297d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\46218627 = "C:\\PROGRA~3\\46218627\\46218627.exe"	46218627.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1988	46218627.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe
1988	46218627.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2364	1268	661cf7862181fdb9ae19c598a448297d.exe	29
PID 1268 wrote to memory of 2364	1268	661cf7862181fdb9ae19c598a448297d.exe	29
PID 1268 wrote to memory of 2364	1268	661cf7862181fdb9ae19c598a448297d.exe	29
PID 1268 wrote to memory of 2364	1268	661cf7862181fdb9ae19c598a448297d.exe	29
PID 2364 wrote to memory of 2348	2364	cmd.exe	30
PID 2364 wrote to memory of 2348	2364	cmd.exe	30
PID 2364 wrote to memory of 2348	2364	cmd.exe	30
PID 2364 wrote to memory of 2348	2364	cmd.exe	30
PID 2348 wrote to memory of 1988	2348	cmd.exe	31
PID 2348 wrote to memory of 1988	2348	cmd.exe	31
PID 2348 wrote to memory of 1988	2348	cmd.exe	31
PID 2348 wrote to memory of 1988	2348	cmd.exe	31

C:\Users\Admin\AppData\Local\Temp\661cf7862181fdb9ae19c598a448297d.exe
"C:\Users\Admin\AppData\Local\Temp\661cf7862181fdb9ae19c598a448297d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\ProgramData\46218627\46218627.bat" "
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start C:\PROGRA~3\46218627\46218627.exe /i
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2348
  - - C:\PROGRA~3\46218627\46218627.exe
      C:\PROGRA~3\46218627\46218627.exe /i
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~3\46218627\46218627.exe

Filesize
860KB

MD5
661cf7862181fdb9ae19c598a448297d

SHA1
a2da5641be4aa32d77856939c2648edfc857cc7d

SHA256
942a4b8b89e8363c9546971d2d8f8573efc39ed8d672200e4565a3b84f690151

SHA512
fd3db6720b95a1b56a6ea548e6d407e0058d6030d601c43f7c1045a4e741a77cb0ec58bc2b17221ddd85fbd75a31f880d9049bd0afed76b5a08bc6e125db78db

Download Submit
C:\ProgramData\46218627\46218627.bat

Filesize
230B

MD5
692fe65ec893a37968bcc41e99bfc955

SHA1
f8bd059a610d9bb9e8905021af1ec6a90bff2d17

SHA256
b1744d949d18fe313a0f383995b3b3f1f5bf8191afb76acfa8d2edb1267203aa

SHA512
08aac769fdd8f39f65dc12a2ecd98c6d046531e92af1c9b66665b2526ac3beb67d35f2c19cb53d703e01f7c2af35a0c42cf24befe6fd187c2afbb0d9f8d4fb2e

Download Submit
memory/1268-1-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1268-2-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/1268-3-0x00000000001B0000-0x00000000001B2000-memory.dmp

Filesize
8KB

Download
memory/1268-4-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/1268-14-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1988-31-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1988-35-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1988-25-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1988-23-0x0000000000670000-0x0000000000770000-memory.dmp

Filesize
1024KB

Download
memory/1988-30-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1988-21-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1988-32-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/1988-33-0x0000000000670000-0x0000000000770000-memory.dmp

Filesize
1024KB

Download
memory/1988-34-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1988-22-0x0000000000220000-0x0000000000222000-memory.dmp

Filesize
8KB

Download
memory/1988-36-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1988-38-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1988-39-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1988-40-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1988-41-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1988-42-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download
memory/1988-47-0x0000000000400000-0x0000000000589000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads