118021742eb8f1beac97119265aae0a4e9da963e671733e8dfc64746f320f47c

General

Target

abf3e9c66337d31799a60cb211d4811a.exe
Size

280KB
MD5

abf3e9c66337d31799a60cb211d4811a
SHA1

a8b40ce2a175b5377d5d5830757886ce0325e0ed
SHA256

118021742eb8f1beac97119265aae0a4e9da963e671733e8dfc64746f320f47c
SHA512

b7fd834177c914f0a0d974f5c6dd5c4423a98aaa70f370fc0d32173cbb1e5e7916e6759edc88d0d852c6543f1057f051673ea64050704e9e7d49df0d0449091d
SSDEEP

3072:SPCEEkfk5qasl5jcChjXdVZXI1jqQ7S2pCxCN6ja83Vt13GQAb5pnpvs:SaE/0qasl1hVDQ7SoNg13gbi

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1632	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2952	lassa.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	lassa.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\lassa.exe	abf3e9c66337d31799a60cb211d4811a.exe
File opened for modification	C:\Windows\lassa.exe	abf3e9c66337d31799a60cb211d4811a.exe

Modifies data under HKEY_USERS 26 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	lassa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36D5872D-0B61-4612-8A67-EEEFA5893B72}\f2-cc-6d-26-38-6d	lassa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	lassa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-cc-6d-26-38-6d\WpadDecision = "0"	lassa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	lassa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36D5872D-0B61-4612-8A67-EEEFA5893B72}\WpadDecision = "0"	lassa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36D5872D-0B61-4612-8A67-EEEFA5893B72}\WpadNetworkName = "Network 3"	lassa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36D5872D-0B61-4612-8A67-EEEFA5893B72}	lassa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-cc-6d-26-38-6d	lassa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	lassa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ea000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	lassa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	lassa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	lassa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	lassa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36D5872D-0B61-4612-8A67-EEEFA5893B72}\WpadDecisionTime = 60aa9649476ada01	lassa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-cc-6d-26-38-6d\WpadDecisionReason = "1"	lassa.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	lassa.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{36D5872D-0B61-4612-8A67-EEEFA5893B72}\WpadDecisionReason = "1"	lassa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	lassa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-cc-6d-26-38-6d\WpadDecisionTime = 60aa9649476ada01	lassa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	lassa.exe
Key created	\REGISTRY\USER\.DEFAULT\SoftWare\Microsoft\Windows\CurrentVersion\Run	lassa.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	lassa.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	lassa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	lassa.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lassa.exe = "lassa.exe"	lassa.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2952	lassa.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 1632	2944	abf3e9c66337d31799a60cb211d4811a.exe	29
PID 2944 wrote to memory of 1632	2944	abf3e9c66337d31799a60cb211d4811a.exe	29
PID 2944 wrote to memory of 1632	2944	abf3e9c66337d31799a60cb211d4811a.exe	29
PID 2944 wrote to memory of 1632	2944	abf3e9c66337d31799a60cb211d4811a.exe	29

C:\Users\Admin\AppData\Local\Temp\abf3e9c66337d31799a60cb211d4811a.exe
"C:\Users\Admin\AppData\Local\Temp\abf3e9c66337d31799a60cb211d4811a.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Delete.bat
  2⤵
  - Deletes itself
  PID:1632

C:\Windows\lassa.exe
C:\Windows\lassa.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Delete.bat

Filesize
190B

MD5
aa9e3d10529fbd54043e5d1e6c53dc33

SHA1
71fafd22d0a8fa30650ce8d21ebade5f01a9a7e0

SHA256
614bdfdfad512f153b3695e1791a4848688e7fd70c1706a5b5f55bd47c5b2aa8

SHA512
ad50cea4b3c29d19c489cdc04cccb25b3aadc87df8b2e68ab0d5a4df2fbd73cd8cca956ebfe90a75c7ea24fc6081b75e2401429ea0d7e9efa6c62758432e672c

Download Submit
C:\Windows\lassa.exe

Filesize
280KB

MD5
abf3e9c66337d31799a60cb211d4811a

SHA1
a8b40ce2a175b5377d5d5830757886ce0325e0ed

SHA256
118021742eb8f1beac97119265aae0a4e9da963e671733e8dfc64746f320f47c

SHA512
b7fd834177c914f0a0d974f5c6dd5c4423a98aaa70f370fc0d32173cbb1e5e7916e6759edc88d0d852c6543f1057f051673ea64050704e9e7d49df0d0449091d

Download Submit
memory/2944-0-0x0000000000400000-0x0000000000439500-memory.dmp

Filesize
229KB

Download
memory/2944-13-0x0000000000400000-0x0000000000439500-memory.dmp

Filesize
229KB

Download
memory/2952-4-0x0000000000400000-0x0000000000439500-memory.dmp

Filesize
229KB

Download
memory/2952-15-0x0000000000400000-0x0000000000439500-memory.dmp

Filesize
229KB

Download
memory/2952-19-0x0000000000400000-0x0000000000439500-memory.dmp

Filesize
229KB

Download
memory/2952-24-0x0000000000400000-0x0000000000439500-memory.dmp

Filesize
229KB

Download

Analysis

Sharing