c1a4489253bfb2f72cc569ef75089f4361182d2aad45ce02c2c51e2503fd15fc

General

Target

ad028fdd212fde763434224a756129f9.exe
Size

923KB
MD5

ad028fdd212fde763434224a756129f9
SHA1

98b2aaf0e82e6a74c4bc244dc0407cb94b88a7f1
SHA256

c1a4489253bfb2f72cc569ef75089f4361182d2aad45ce02c2c51e2503fd15fc
SHA512

73b2f4305f1d413faf5c5192a4d3f9ae001a0b9923675ff86c793d9f388ce64b029b5521b235f4a8919d39de367ca3112da2d4f04722aef397e1ed89fb545f61
SSDEEP

24576:VRmJkcoQricOIQxiZY1WNRNinFBoSLhmgdc7:6JZoQrbTFZY1WNRNiToujg

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ztjtebhze.exe\DisableExceptionChainValidation	ad028fdd212fde763434224a756129f9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ztjtebhze.exe	ad028fdd212fde763434224a756129f9.exe

Executes dropped EXE 1 IoCs

pid	Process
3044	ad028fdd212fde763434224a756129f9.exe

Loads dropped DLL 1 IoCs

pid	Process
2212	ad028fdd212fde763434224a756129f9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Windows\CurrentVersion\Run\ad028fdd212fde763434224a756129f9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad028fdd212fde763434224a756129f9.exe"	ad028fdd212fde763434224a756129f9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ad028fdd212fde763434224a756129f9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad028fdd212fde763434224a756129f9.exe"	ad028fdd212fde763434224a756129f9.exe

Checks for any installed AV software in registry 1 TTPs 2 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Avira	ad028fdd212fde763434224a756129f9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\avast! Antivirus	ad028fdd212fde763434224a756129f9.exe

AutoIT Executable 4 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/2212-0-0x0000000000400000-0x00000000004B4000-memory.dmp	autoit_exe
behavioral1/files/0x000e000000015c85-8.dat	autoit_exe
behavioral1/memory/2644-35-0x0000000000110000-0x0000000000245000-memory.dmp	autoit_exe
behavioral1/memory/2644-38-0x0000000000110000-0x0000000000245000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2212 set thread context of 3044	2212	ad028fdd212fde763434224a756129f9.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ad028fdd212fde763434224a756129f9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ad028fdd212fde763434224a756129f9.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	ad028fdd212fde763434224a756129f9.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2576	schtasks.exe

Modifies registry class 7 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\CLSID\{43A92A40-8CBE-4746-8DF8-EEB10AC49B48}\171F043C\CG1\HAL = 05ee0000	ad028fdd212fde763434224a756129f9.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\CLSID\{43A92A40-8CBE-4746-8DF8-EEB10AC49B48}\171F043C\ê't3	ad028fdd212fde763434224a756129f9.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\CLSID\{43A92A40-8CBE-4746-8DF8-EEB10AC49B48}\171F043C\ê't3\BID = 200008001c000200e8070000140000001c0016001900060000000000c2b2df65	ad028fdd212fde763434224a756129f9.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\CLSID\{43A92A40-8CBE-4746-8DF8-EEB10AC49B48}\171F043C\CG1	ad028fdd212fde763434224a756129f9.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\CLSID	ad028fdd212fde763434224a756129f9.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\CLSID\{43A92A40-8CBE-4746-8DF8-EEB10AC49B48}	ad028fdd212fde763434224a756129f9.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\CLSID\{43A92A40-8CBE-4746-8DF8-EEB10AC49B48}\171F043C	ad028fdd212fde763434224a756129f9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2212	ad028fdd212fde763434224a756129f9.exe
2212	ad028fdd212fde763434224a756129f9.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3044	ad028fdd212fde763434224a756129f9.exe
3044	ad028fdd212fde763434224a756129f9.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3044	ad028fdd212fde763434224a756129f9.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	3044	ad028fdd212fde763434224a756129f9.exe
Token: SeBackupPrivilege	3044	ad028fdd212fde763434224a756129f9.exe
Token: SeDebugPrivilege	3044	ad028fdd212fde763434224a756129f9.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3044	2212	ad028fdd212fde763434224a756129f9.exe	28
PID 2212 wrote to memory of 3044	2212	ad028fdd212fde763434224a756129f9.exe	28
PID 2212 wrote to memory of 3044	2212	ad028fdd212fde763434224a756129f9.exe	28
PID 2212 wrote to memory of 3044	2212	ad028fdd212fde763434224a756129f9.exe	28
PID 2212 wrote to memory of 3044	2212	ad028fdd212fde763434224a756129f9.exe	28
PID 2212 wrote to memory of 3044	2212	ad028fdd212fde763434224a756129f9.exe	28
PID 3044 wrote to memory of 2576	3044	ad028fdd212fde763434224a756129f9.exe	29
PID 3044 wrote to memory of 2576	3044	ad028fdd212fde763434224a756129f9.exe	29
PID 3044 wrote to memory of 2576	3044	ad028fdd212fde763434224a756129f9.exe	29
PID 3044 wrote to memory of 2576	3044	ad028fdd212fde763434224a756129f9.exe	29
PID 3044 wrote to memory of 2644	3044	ad028fdd212fde763434224a756129f9.exe	31
PID 3044 wrote to memory of 2644	3044	ad028fdd212fde763434224a756129f9.exe	31
PID 3044 wrote to memory of 2644	3044	ad028fdd212fde763434224a756129f9.exe	31
PID 3044 wrote to memory of 2644	3044	ad028fdd212fde763434224a756129f9.exe	31
PID 3044 wrote to memory of 2644	3044	ad028fdd212fde763434224a756129f9.exe	31
PID 3044 wrote to memory of 2644	3044	ad028fdd212fde763434224a756129f9.exe	31
PID 3044 wrote to memory of 2644	3044	ad028fdd212fde763434224a756129f9.exe	31

C:\Users\Admin\AppData\Local\Temp\ad028fdd212fde763434224a756129f9.exe
"C:\Users\Admin\AppData\Local\Temp\ad028fdd212fde763434224a756129f9.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\ad028fdd212fde763434224a756129f9.exe
  "C:\Users\Admin\AppData\Local\Temp\ad028fdd212fde763434224a756129f9.exe"
  2⤵
  - Sets file execution options in registry
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: MapViewOfSection
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x171F043C" /TR "C:\ProgramData\macromisoft0\ztjtebhze.exe" /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2576
- - C:\Windows\SysWOW64\WerFault.exe
    "C:\Windows\SysWOW64\WerFault.exe"
    3⤵
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Software Discovery

1

T1518

Security Software Discovery

1

T1518.001

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\c6wGUdKCsLNqrYYJ9.caa

Filesize
277KB

MD5
3ecd46554e0ae7a8b2bc68180ee2bdc7

SHA1
dfcceaade731f5f4bab9a9251dfc38448e1cb519

SHA256
77eecc9201efd4c8b4c3728e01ede085c7474ba510ea73fe65413269de225f0c

SHA512
34014c02c37d33ffde560f2276fffd6d56810fbb69411d3d26222f14d4ffbef73043ce108300adf226670c734c6c3f6c78826351af2a1bb04a282ba1bd50afad

Download Submit
\Users\Admin\AppData\Local\Temp\ad028fdd212fde763434224a756129f9.exe

Filesize
923KB

MD5
ad028fdd212fde763434224a756129f9

SHA1
98b2aaf0e82e6a74c4bc244dc0407cb94b88a7f1

SHA256
c1a4489253bfb2f72cc569ef75089f4361182d2aad45ce02c2c51e2503fd15fc

SHA512
73b2f4305f1d413faf5c5192a4d3f9ae001a0b9923675ff86c793d9f388ce64b029b5521b235f4a8919d39de367ca3112da2d4f04722aef397e1ed89fb545f61

Download Submit
memory/2212-0-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2644-38-0x0000000000110000-0x0000000000245000-memory.dmp

Filesize
1.2MB

Download
memory/2644-37-0x00000000771E0000-0x0000000077361000-memory.dmp

Filesize
1.5MB

Download
memory/2644-35-0x0000000000110000-0x0000000000245000-memory.dmp

Filesize
1.2MB

Download
memory/2644-34-0x00000000771E0000-0x0000000077361000-memory.dmp

Filesize
1.5MB

Download
memory/3044-22-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3044-27-0x0000000000460000-0x00000000004AB000-memory.dmp

Filesize
300KB

Download
memory/3044-19-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3044-21-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3044-24-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/3044-17-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3044-23-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3044-25-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3044-26-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3044-18-0x0000000000020000-0x0000000000022000-memory.dmp

Filesize
8KB

Download
memory/3044-28-0x00000000022E0000-0x00000000022E9000-memory.dmp

Filesize
36KB

Download
memory/3044-30-0x0000000002330000-0x0000000002331000-memory.dmp

Filesize
4KB

Download
memory/3044-29-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/3044-16-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3044-36-0x0000000000460000-0x00000000004AB000-memory.dmp

Filesize
300KB

Download
memory/3044-13-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/3044-11-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/3044-9-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads