67005569927952ef66ba77bd1a50dfc6f55677d37e2cd22f56a0de84c2e89105

General

Target

6fe61c04c885bafd5b1db3d8baff76a0.exe
Size

181KB
MD5

6fe61c04c885bafd5b1db3d8baff76a0
SHA1

7bf9624081db706b75e56f1fa35155b7277b25f7
SHA256

67005569927952ef66ba77bd1a50dfc6f55677d37e2cd22f56a0de84c2e89105
SHA512

b0c7193a16e6716d911465f7a0dd76ded07522c95b2b9a35b22e27ca0248f9a7cdecf7136c00647e45b7133320868e6c93556dae8438bcc4722ba4b9e98cbdd6
SSDEEP

3072:5jEmLFtjR7iWj9XrTBsoe7De/sqe8ThcUE0LQPWE8Hanargoee:ZEmLHRmWj96oe7ykScU/LQP0HaJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2492	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2492	svchost.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell	6fe61c04c885bafd5b1db3d8baff76a0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\run	6fe61c04c885bafd5b1db3d8baff76a0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\run\command	6fe61c04c885bafd5b1db3d8baff76a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\run\command\ = "\"%1\" %*"	6fe61c04c885bafd5b1db3d8baff76a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "exploer.exe %1 %*"	6fe61c04c885bafd5b1db3d8baff76a0.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\exploer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\winlogon.dll	svchost.exe
File created	C:\Windows\SysWOW64\winlogon.dll	svchost.exe
File opened for modification	C:\Windows\SysWOW64\exploer.exe	6fe61c04c885bafd5b1db3d8baff76a0.exe
File created	C:\Windows\SysWOW64\exploer.exe	6fe61c04c885bafd5b1db3d8baff76a0.exe
File opened for modification	C:\Windows\SysWOW64\winlogon.dll	6fe61c04c885bafd5b1db3d8baff76a0.exe
File created	C:\Windows\SysWOW64\winlogon.dll	6fe61c04c885bafd5b1db3d8baff76a0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.exe	6fe61c04c885bafd5b1db3d8baff76a0.exe
File created	C:\Windows\svchost.exe	6fe61c04c885bafd5b1db3d8baff76a0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	6fe61c04c885bafd5b1db3d8baff76a0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\Shell	6fe61c04c885bafd5b1db3d8baff76a0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\run	6fe61c04c885bafd5b1db3d8baff76a0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\run\command	6fe61c04c885bafd5b1db3d8baff76a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\run\command\ = "\"%1\" %*"	6fe61c04c885bafd5b1db3d8baff76a0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "exploer.exe %1 %*"	6fe61c04c885bafd5b1db3d8baff76a0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2492	svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2492	2528	6fe61c04c885bafd5b1db3d8baff76a0.exe	28
PID 2528 wrote to memory of 2492	2528	6fe61c04c885bafd5b1db3d8baff76a0.exe	28
PID 2528 wrote to memory of 2492	2528	6fe61c04c885bafd5b1db3d8baff76a0.exe	28
PID 2528 wrote to memory of 2492	2528	6fe61c04c885bafd5b1db3d8baff76a0.exe	28

C:\Users\Admin\AppData\Local\Temp\6fe61c04c885bafd5b1db3d8baff76a0.exe
"C:\Users\Admin\AppData\Local\Temp\6fe61c04c885bafd5b1db3d8baff76a0.exe"
1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

1

T1546.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\winlogon.dll

Filesize
44KB

MD5
cafd413c4b287e0b697dc8ee2f9e864c

SHA1
8c64e2792a3e0b25a6a31ee6ed72ca59a51ab3bc

SHA256
d8d8758ae1c43a8cf029093747c92b1984eb24f1fb3935cf2e35ddf645c49986

SHA512
2ece1f67af3bc3b5fc943c13934fc2679021a8c6c744a83ee3c7c08125d90568404940b488726036d8e3e47647fc94920e01c141a2c6d2ea0c18129946141315

Download Submit
C:\Windows\svchost.exe

Filesize
181KB

MD5
6fe61c04c885bafd5b1db3d8baff76a0

SHA1
7bf9624081db706b75e56f1fa35155b7277b25f7

SHA256
67005569927952ef66ba77bd1a50dfc6f55677d37e2cd22f56a0de84c2e89105

SHA512
b0c7193a16e6716d911465f7a0dd76ded07522c95b2b9a35b22e27ca0248f9a7cdecf7136c00647e45b7133320868e6c93556dae8438bcc4722ba4b9e98cbdd6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads