a835329d85cf0a2529ee48e6caa71ae8b2d7b374ef34eb92d4d2b8dc08c1b486

General

Target

87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
Size

144KB
MD5

87bdb0a2b3efeb7dbbf36b7ff3eb5761
SHA1

0ad7893f39aef48d8ff1eb9f14e6305f07f4a42f
SHA256

a835329d85cf0a2529ee48e6caa71ae8b2d7b374ef34eb92d4d2b8dc08c1b486
SHA512

ed0f5a3da64a122611a14051eb620bcfc5ce77d9d884fc54f7d6b6617bfb54613d9b2355911f2f024e5b3c4caaa254adba58f5512821a7eec7a825e914e01103
SSDEEP

3072:KhAMV3kvJoUv3+fMH9nwyIaozwi973Pe2a:KhzOIaywi973PH

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\System32\\subprnp.vbs"	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe

Drops file in System32 directory 23 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Funny Game with Eggs.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Kaspersky AntiVirus Key !!working!!.reg.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\subprnp.vbs	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\Winkernel32.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Microsoft MSN Messenger 7 Plus.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Family_surfin_with_childs.jpg.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\We_in_disneyland!.jpg.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Free Desktop Wallpaper.bmp.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File opened for modification	C:\Windows\SysWOW64\subprnp.vbs	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File opened for modification	C:\Windows\SysWOW64\prnmskv.vbs	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\my_own_picture_for_you.bmp.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Mum and Dad chillin.jpg.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Battlefield 2 Crack.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File opened for modification	C:\Windows\SysWOW64\msdriverdll32.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\msdriverdll32.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\skpwisa.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\a_huge_dog_sitting_in_a_chair.jpg.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\A very huge elephant!!.jpg.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File opened for modification	C:\Windows\SysWOW64\skpwisa.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File opened for modification	C:\Windows\SysWOW64\Winkernel32.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\prnmskv.vbs	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\sk0r_mailer.vbs	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Waterfall_in_autria.jpg.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Win32SkorInfo.html	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File opened for modification	C:\Windows\Win32SkorInfo.html	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File created	C:\Windows\Bestes_Bild.gif.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
File opened for modification	C:\Windows\Bestes_Bild.gif.exe	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.skorpay	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.skorpay\massmailing = "mailed"	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.skorpay\installed = "fertig"	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.skorpay\counter = "1"	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.skorpay\anfangwert = "sk0r"	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2448	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
Token: SeSecurityPrivilege	2448	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
Token: SeSecurityPrivilege	2448	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
Token: SeSecurityPrivilege	2448	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
Token: SeSecurityPrivilege	2448	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2448	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1528	2448	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe	28
PID 2448 wrote to memory of 1528	2448	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe	28
PID 2448 wrote to memory of 1528	2448	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe	28
PID 2448 wrote to memory of 1528	2448	87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe	28

C:\Users\Admin\AppData\Local\Temp\87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe
"C:\Users\Admin\AppData\Local\Temp\87bdb0a2b3efeb7dbbf36b7ff3eb5761.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\System32\sk0r_mailer.vbs"
  2⤵
  PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\3787\Familien_Bilder_usw\my_own_picture_for_you.bmp.exe

Filesize
144KB

MD5
87bdb0a2b3efeb7dbbf36b7ff3eb5761

SHA1
0ad7893f39aef48d8ff1eb9f14e6305f07f4a42f

SHA256
a835329d85cf0a2529ee48e6caa71ae8b2d7b374ef34eb92d4d2b8dc08c1b486

SHA512
ed0f5a3da64a122611a14051eb620bcfc5ce77d9d884fc54f7d6b6617bfb54613d9b2355911f2f024e5b3c4caaa254adba58f5512821a7eec7a825e914e01103

Download Submit
C:\Windows\SysWOW64\sk0r_mailer.vbs

Filesize
1KB

MD5
b69d0e02d70d0103c98649fb82d5ab66

SHA1
eee8747beaa8d3c93bf90d576c72c2428a723e02

SHA256
cdce16cd89238517643c4fb1ea9da490ef4fa60f758d18545b92d868e0085c61

SHA512
03e664544790cf9db4d74f570d288533a84e58d8be4596141a3a5c436bc85500817ef6a3d3e6822c44f5b1f6d982c325068e9fda0941262bc989bed04bf2e235

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads