9b1305fbc12e89e4e23910cb7867cf6ae9d53e7d425969cb92d184f0f5d1f8b9

General

Target

bc79c83aa79a4a56caf7abe575c37edb.exe
Size

56KB
MD5

bc79c83aa79a4a56caf7abe575c37edb
SHA1

c6b3130b84d616dfee3ad2399734d1aae8f22038
SHA256

9b1305fbc12e89e4e23910cb7867cf6ae9d53e7d425969cb92d184f0f5d1f8b9
SHA512

f7e6f5cdb166b8d0d44e238c284b806b43198e96e291e51ead124075d2da7c31bff641fbfe8199b4a05e823fc31953c7e413b35f1581505e87eb9d0496ce7d48
SSDEEP

768:5GMcZW64cKMfLq2IRZwqXsZUn4YU1px2w/pQXoP7rEBrza:QMqWbcBC6sK2wxE8QBr+

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\System\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	bc79c83aa79a4a56caf7abe575c37edb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\system32\windows.exe = "C:\\Windows\\system32\\windows.exe:*:Enabled:Enabled"	bc79c83aa79a4a56caf7abe575c37edb.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\bc79c83aa79a4a56caf7abe575c37edb.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bc79c83aa79a4a56caf7abe575c37edb.exe:*:Enabled:Enabled"	bc79c83aa79a4a56caf7abe575c37edb.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WINDOWS = "C:\\Windows\\system32\\windows.exe"	bc79c83aa79a4a56caf7abe575c37edb.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\windows.exe	bc79c83aa79a4a56caf7abe575c37edb.exe
File opened for modification	C:\Windows\SysWOW64\windows.exe	bc79c83aa79a4a56caf7abe575c37edb.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2240	bc79c83aa79a4a56caf7abe575c37edb.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeAssignPrimaryTokenPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeLockMemoryPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeIncreaseQuotaPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeMachineAccountPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeTcbPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeSecurityPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeTakeOwnershipPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeLoadDriverPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeSystemProfilePrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeSystemtimePrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeProfSingleProcessPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeIncBasePriorityPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeCreatePagefilePrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeCreatePermanentPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeBackupPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeRestorePrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeShutdownPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeDebugPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeAuditPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeSystemEnvironmentPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeChangeNotifyPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeRemoteShutdownPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeUndockPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeSyncAgentPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeEnableDelegationPrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe
Token: SeManageVolumePrivilege	2240	bc79c83aa79a4a56caf7abe575c37edb.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 616	2240	bc79c83aa79a4a56caf7abe575c37edb.exe	9

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:616

C:\Users\Admin\AppData\Local\Temp\bc79c83aa79a4a56caf7abe575c37edb.exe
"C:\Users\Admin\AppData\Local\Temp\bc79c83aa79a4a56caf7abe575c37edb.exe"
1⤵
- Modifies firewall policy service
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-2-0x0000000013140000-0x000000001314F000-memory.dmp

Filesize
60KB

Download
memory/2240-0-0x0000000013140000-0x000000001314F000-memory.dmp

Filesize
60KB

Download
memory/2240-4-0x0000000013140000-0x000000001314F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads