115b82cee172aa8e3f830b03f9af5d905751e8df10bba2dc3e54b54bb57bcfb5

General

Target

7c9d12576bf9af2cca6ca1f1f10dd31f.exe
Size

186KB
MD5

7c9d12576bf9af2cca6ca1f1f10dd31f
SHA1

097caf6e02458f15d108989763bde85a2070203c
SHA256

115b82cee172aa8e3f830b03f9af5d905751e8df10bba2dc3e54b54bb57bcfb5
SHA512

bc4916053804243463abc9fea6200181443c3dfb1c9458e1bde9723db175826807d733f79cbf32865bcf823b5e9bdf393e4f3e837fe7742bb8339951f4f7eb6a
SSDEEP

3072:YjbZjtO5rhRgXrktWBrS36xYCuN8XL/vkY9SDPcChewq0Fr8H9aT9:YjbZpO5ng7ktWlS3AYCFTMY9GPvAo

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

7c9d12576bf9af2cca6ca1f1f10dd31f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe"	7c9d12576bf9af2cca6ca1f1f10dd31f.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7c9d12576bf9af2cca6ca1f1f10dd31f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	7c9d12576bf9af2cca6ca1f1f10dd31f.exe

Executes dropped EXE 1 IoCs

Processes:

avyglh.exe

pid process

1168 avyglh.exe

pid	process
1168	avyglh.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/388-0-0x0000000000400000-0x000000000047A000-memory.dmp	upx
behavioral2/memory/388-1-0x0000000000400000-0x000000000047A000-memory.dmp	upx
behavioral2/memory/388-2-0x0000000000400000-0x000000000047A000-memory.dmp	upx
C:\Users\Admin\avyglh.exe	upx
behavioral2/memory/1168-13-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7c9d12576bf9af2cca6ca1f1f10dd31f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSConfig = "C:\\Users\\Admin\\avyglh.exe \\u"	7c9d12576bf9af2cca6ca1f1f10dd31f.exe

Drops file in System32 directory 3 IoCs

Processes:

7c9d12576bf9af2cca6ca1f1f10dd31f.exeavyglh.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\secupdat.dat	7c9d12576bf9af2cca6ca1f1f10dd31f.exe
File created	C:\Windows\SysWOW64\secupdat.dat	7c9d12576bf9af2cca6ca1f1f10dd31f.exe
File opened for modification	C:\Windows\SysWOW64\secupdat.dat	avyglh.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

avyglh.exe

description pid process target process

PID 1168 set thread context of 1556 1168 avyglh.exe svchost.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

5080 388 WerFault.exe 7c9d12576bf9af2cca6ca1f1f10dd31f.exe
1280 1556 WerFault.exe svchost.exe

description	pid	process	target process
PID 1168 set thread context of 1556	1168	avyglh.exe	svchost.exe

pid	pid_target	process	target process
5080	388	WerFault.exe	7c9d12576bf9af2cca6ca1f1f10dd31f.exe
1280	1556	WerFault.exe	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7c9d12576bf9af2cca6ca1f1f10dd31f.exeavyglh.exe

description	pid	process	target process
PID 388 wrote to memory of 1168	388	7c9d12576bf9af2cca6ca1f1f10dd31f.exe	avyglh.exe
PID 388 wrote to memory of 1168	388	7c9d12576bf9af2cca6ca1f1f10dd31f.exe	avyglh.exe
PID 388 wrote to memory of 1168	388	7c9d12576bf9af2cca6ca1f1f10dd31f.exe	avyglh.exe
PID 388 wrote to memory of 1088	388	7c9d12576bf9af2cca6ca1f1f10dd31f.exe	cmd.exe
PID 388 wrote to memory of 1088	388	7c9d12576bf9af2cca6ca1f1f10dd31f.exe	cmd.exe
PID 388 wrote to memory of 1088	388	7c9d12576bf9af2cca6ca1f1f10dd31f.exe	cmd.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe
PID 1168 wrote to memory of 1556	1168	avyglh.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\7c9d12576bf9af2cca6ca1f1f10dd31f.exe
"C:\Users\Admin\AppData\Local\Temp\7c9d12576bf9af2cca6ca1f1f10dd31f.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 712
2⤵
- Program crash
PID:5080

C:\Users\Admin\avyglh.exe
\u
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1168

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 192
4⤵
- Program crash
PID:1280

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1847.bat" "
2⤵
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 388 -ip 388
1⤵
PID:1800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1556 -ip 1556
1⤵
PID:536

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1847.bat
Filesize
103B

MD5
07e335a6c3d27311192ea73acd27904c

SHA1
54f236d71561519d6da16b46b1d5d743d885596d

SHA256
a4e05b5cf2f133cb8bf3d321dcc14728542a9ccea9095e221d7ff3f9ca72be33

SHA512
44c308b0e342392c10ccbf2491f4d28678d1fe7522e6931f2177e0f5b98b202135a767f8ac978aab58eb2a30735ff6426b3cb7b4dcedb506f3ce4af7eb2ceee7

Download Submit
C:\Users\Admin\avyglh.exe
Filesize
20KB

MD5
2db94b9a49b38f91511dd3690afad931

SHA1
eb0364593936af131fcf5ce02f1e15d08cea9bdf

SHA256
41b4b0ed265fc6d59c5b1df6ab54ee3d07f3deb65f935c9c54529d85d27c5f41

SHA512
acc5a75fe759a30b2d712f855c4c87d9793265e329fd9a36d33b7da15ce40cbb228c3d364d7456e7985a58019a05b0ddb0ff86fc416fd121d013a7ee4f87e26e

Download Submit
C:\Windows\SysWOW64\secupdat.dat
Filesize
70KB

MD5
ef3c813684ec76eb5f9bc146559702c5

SHA1
a680f6bfcfd878e55a1c073502bf56cfc14674b0

SHA256
41cf0bb0a81f9643c00119dfd427aec915a14546d840d4ef9a10580f4376bf0c

SHA512
97acea936a79a043aacbcd9ec9cc64aeb15126cbd292027a9b6255cf6e155c6f46f4acc61d546436382d231346734c0c6ab4c1460ebd0d3115d78a2c96a88d85

Download Submit
memory/388-6-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/388-1-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/388-3-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/388-0-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/388-17-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/388-2-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/1168-19-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1168-13-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1168-25-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1556-21-0x0000000009900000-0x0000000009915000-memory.dmp

Filesize
84KB

Download
memory/1556-26-0x0000000009900000-0x0000000009915000-memory.dmp

Filesize
84KB

Download
memory/1556-32-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/1556-33-0x0000000009900000-0x0000000009915000-memory.dmp

Filesize
84KB

Download
memory/1556-31-0x0000000009900000-0x0000000009915000-memory.dmp

Filesize
84KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads