8e5d78774044ceba3066a0214ea16f1718f5489b8d4a8a53984b925072c7fa16

Reason

Machine shutdown

General

Target

752501dcf3fb2da30771709d786d1bf1.exe
Size

195KB
MD5

752501dcf3fb2da30771709d786d1bf1
SHA1

92d352e23f0695307ff42fe32c0cc6939f11a7aa
SHA256

8e5d78774044ceba3066a0214ea16f1718f5489b8d4a8a53984b925072c7fa16
SHA512

cb18a13a0e2ac6d4cf8250fc306ed288f765212028ac5e93732b4c3ba300874bf81ce672f3cf392a12662161a197c5da83487239a9051abf4a311420942eb6a3
SSDEEP

6144:zX88dBeX5oci4bz/uSxd+8ncml+8EbPqN:DBdBy5cEvQ8EbP2

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Explorer.EXE

pid process

1208 Explorer.EXE

pid	process
1208	Explorer.EXE

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Processes:

752501dcf3fb2da30771709d786d1bf1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	752501dcf3fb2da30771709d786d1bf1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	752501dcf3fb2da30771709d786d1bf1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3308111660-3636268597-2291490419-1000\\$6367fb4bb5c9d074f341f311a16214c0\\n."	752501dcf3fb2da30771709d786d1bf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$6367fb4bb5c9d074f341f311a16214c0\\n."	752501dcf3fb2da30771709d786d1bf1.exe

Unexpected DNS network traffic destination 8 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20
Destination IP	83.133.123.20

Modifies registry class 6 IoCs

Processes:

752501dcf3fb2da30771709d786d1bf1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\clsid	752501dcf3fb2da30771709d786d1bf1.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	752501dcf3fb2da30771709d786d1bf1.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32	752501dcf3fb2da30771709d786d1bf1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both"	752501dcf3fb2da30771709d786d1bf1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3308111660-3636268597-2291490419-1000\\$6367fb4bb5c9d074f341f311a16214c0\\n."	752501dcf3fb2da30771709d786d1bf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$6367fb4bb5c9d074f341f311a16214c0\\n."	752501dcf3fb2da30771709d786d1bf1.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

752501dcf3fb2da30771709d786d1bf1.exe

pid	process
2012	752501dcf3fb2da30771709d786d1bf1.exe
2012	752501dcf3fb2da30771709d786d1bf1.exe
2012	752501dcf3fb2da30771709d786d1bf1.exe
2012	752501dcf3fb2da30771709d786d1bf1.exe
2012	752501dcf3fb2da30771709d786d1bf1.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

752501dcf3fb2da30771709d786d1bf1.exe

description	pid	process
Token: SeDebugPrivilege	2012	752501dcf3fb2da30771709d786d1bf1.exe
Token: SeDebugPrivilege	2012	752501dcf3fb2da30771709d786d1bf1.exe
Token: SeDebugPrivilege	2012	752501dcf3fb2da30771709d786d1bf1.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

752501dcf3fb2da30771709d786d1bf1.exe

description	pid	process	target process
PID 2012 wrote to memory of 1208	2012	752501dcf3fb2da30771709d786d1bf1.exe	Explorer.EXE
PID 2012 wrote to memory of 1208	2012	752501dcf3fb2da30771709d786d1bf1.exe	Explorer.EXE
PID 2012 wrote to memory of 468	2012	752501dcf3fb2da30771709d786d1bf1.exe	services.exe

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:468

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Executes dropped EXE
PID:1208

C:\Users\Admin\AppData\Local\Temp\752501dcf3fb2da30771709d786d1bf1.exe
"C:\Users\Admin\AppData\Local\Temp\752501dcf3fb2da30771709d786d1bf1.exe"
2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3308111660-3636268597-2291490419-1000\$6367fb4bb5c9d074f341f311a16214c0\n
Filesize
41KB

MD5
fb4e3236959152a057bc6b7603c538ef

SHA1
b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

SHA256
8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

SHA512
993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

Download Submit
memory/1208-8-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1208-12-0x0000000002BE0000-0x0000000002BE1000-memory.dmp

Filesize
4KB

Download
memory/2012-0-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2012-2-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2012-1-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2012-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2012-4-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2012-5-0x0000000000230000-0x0000000000262000-memory.dmp

Filesize
200KB

Download
memory/2012-6-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2012-7-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads