18a6cb3652dcfdae5aa74f5a64bcb4f3ebb75d0878218d86c8113760ae4b3822

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 09:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6509d5c6404d88a8742696670910f648.exe
Size

746KB
MD5

6509d5c6404d88a8742696670910f648
SHA1

6cbf330f7cd3cdd7eb38e8c882aabe564b1ab997
SHA256

18a6cb3652dcfdae5aa74f5a64bcb4f3ebb75d0878218d86c8113760ae4b3822
SHA512

c70c131c6cf20cde8c3b008cd765f3a3109c008241531c4d4e5cf3759969f6a990be0926410bba77d5d170dd80472c8d0e904a2f5d0439ec2108732cb684b190
SSDEEP

12288:s05CNifM2cXMhlUOW5Ap8q3+CsEgl99Fw6vOEIk9Pg25azNd4M6g3DWKDN34:x0V2G5OW5Ap8WanXQ6v1Ik9vT3WN3

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2084	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
1680	Coordinator.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Coordinator.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Coordinator.exe	6509d5c6404d88a8742696670910f648.exe
File opened for modification	C:\Windows\Coordinator.exe	6509d5c6404d88a8742696670910f648.exe
File created	C:\Windows\uninstal.bat	6509d5c6404d88a8742696670910f648.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Coordinator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0063000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Coordinator.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22A2918A-72CF-4409-A524-BB64374CBB43}	Coordinator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-e2-c3-88-7f-7b\WpadDecisionTime = 10548523f049da01	Coordinator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Coordinator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Coordinator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Coordinator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0063000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Coordinator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Coordinator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Coordinator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22A2918A-72CF-4409-A524-BB64374CBB43}\WpadDecision = "0"	Coordinator.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-e2-c3-88-7f-7b	Coordinator.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22A2918A-72CF-4409-A524-BB64374CBB43}\ca-e2-c3-88-7f-7b	Coordinator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-e2-c3-88-7f-7b\WpadDecisionReason = "1"	Coordinator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-e2-c3-88-7f-7b\WpadDecision = "0"	Coordinator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Coordinator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22A2918A-72CF-4409-A524-BB64374CBB43}\WpadDecisionTime = 10548523f049da01	Coordinator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Coordinator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-e2-c3-88-7f-7b\WpadDecisionTime = d00921e5ef49da01	Coordinator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Coordinator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22A2918A-72CF-4409-A524-BB64374CBB43}\WpadDecisionTime = d00921e5ef49da01	Coordinator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Coordinator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Coordinator.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Coordinator.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Coordinator.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22A2918A-72CF-4409-A524-BB64374CBB43}\WpadDecisionReason = "1"	Coordinator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{22A2918A-72CF-4409-A524-BB64374CBB43}\WpadNetworkName = "Network 3"	Coordinator.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ca-e2-c3-88-7f-7b\WpadDetectedUrl	Coordinator.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	6509d5c6404d88a8742696670910f648.exe
Token: SeDebugPrivilege	1680	Coordinator.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1680	Coordinator.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 2744	1680	Coordinator.exe	29
PID 1680 wrote to memory of 2744	1680	Coordinator.exe	29
PID 1680 wrote to memory of 2744	1680	Coordinator.exe	29
PID 1680 wrote to memory of 2744	1680	Coordinator.exe	29
PID 3052 wrote to memory of 2084	3052	6509d5c6404d88a8742696670910f648.exe	31
PID 3052 wrote to memory of 2084	3052	6509d5c6404d88a8742696670910f648.exe	31
PID 3052 wrote to memory of 2084	3052	6509d5c6404d88a8742696670910f648.exe	31
PID 3052 wrote to memory of 2084	3052	6509d5c6404d88a8742696670910f648.exe	31
PID 3052 wrote to memory of 2084	3052	6509d5c6404d88a8742696670910f648.exe	31
PID 3052 wrote to memory of 2084	3052	6509d5c6404d88a8742696670910f648.exe	31
PID 3052 wrote to memory of 2084	3052	6509d5c6404d88a8742696670910f648.exe	31

C:\Users\Admin\AppData\Local\Temp\6509d5c6404d88a8742696670910f648.exe
"C:\Users\Admin\AppData\Local\Temp\6509d5c6404d88a8742696670910f648.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\uninstal.bat
  2⤵
  - Deletes itself
  PID:2084

C:\Windows\Coordinator.exe
C:\Windows\Coordinator.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Coordinator.exe

Filesize
746KB

MD5
6509d5c6404d88a8742696670910f648

SHA1
6cbf330f7cd3cdd7eb38e8c882aabe564b1ab997

SHA256
18a6cb3652dcfdae5aa74f5a64bcb4f3ebb75d0878218d86c8113760ae4b3822

SHA512
c70c131c6cf20cde8c3b008cd765f3a3109c008241531c4d4e5cf3759969f6a990be0926410bba77d5d170dd80472c8d0e904a2f5d0439ec2108732cb684b190

Download Submit
C:\Windows\uninstal.bat

Filesize
190B

MD5
6983354322a95fea648320d04f691328

SHA1
a0c06502ba55b2b73d72ab2f87f63cd9027ce987

SHA256
8ce9375d75298faf8a237021f19136ea33eeb7372a87c8647f5fb5a5eee22d29

SHA512
3ee5cac5372383a30e108eb28f68ce436c27a4ef52f37557764105c10dfd51513935049338a84a1a99003c91c2b5fb60aee3d41c95279dfb38adff1a9634f8e2

Download Submit
memory/1680-11-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1680-15-0x0000000000400000-0x00000000004C3200-memory.dmp

Filesize
780KB

Download
memory/1680-16-0x0000000000400000-0x00000000004C3200-memory.dmp

Filesize
780KB

Download
memory/1680-17-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1680-21-0x0000000000400000-0x00000000004C3200-memory.dmp

Filesize
780KB

Download
memory/3052-0-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/3052-13-0x0000000000400000-0x00000000004C3200-memory.dmp

Filesize
780KB

Download