168b6fbe8b8f0fa03736eeec8e5e3b5a72c049700bfe847cd7050bc97f267649

General

Target

be3f0baa13fecfbf44e07583e2351df7.exe
Size

911KB
MD5

be3f0baa13fecfbf44e07583e2351df7
SHA1

3989229062f1393bccac518002b4625445721063
SHA256

168b6fbe8b8f0fa03736eeec8e5e3b5a72c049700bfe847cd7050bc97f267649
SHA512

9c26974164d5b4f999dffa8c5f59a32dbd6bc868498f300d44e33c4aa32576aa190a25c0a761f6421857bfe934a9ea0d955d064034e2c7ad887ac0c5d6479de6
SSDEEP

12288:Jtb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNTPPpHSgaZpCYcT2wE0XzFHV6A:Jtb20pkaCqT5TBWgNT7aZHIREwBV6A

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2260	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	be3f0baa13fecfbf44e07583e2351df7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	MSShell32.exe

Executes dropped EXE 1 IoCs

pid	Process
4320	MSShell32.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	MSShell32.exe
File opened (read-only)	\??\i:	MSShell32.exe
File opened (read-only)	\??\j:	MSShell32.exe
File opened (read-only)	\??\o:	MSShell32.exe
File opened (read-only)	\??\s:	MSShell32.exe
File opened (read-only)	\??\t:	MSShell32.exe
File opened (read-only)	\??\y:	MSShell32.exe
File opened (read-only)	\??\a:	MSShell32.exe
File opened (read-only)	\??\b:	MSShell32.exe
File opened (read-only)	\??\k:	MSShell32.exe
File opened (read-only)	\??\l:	MSShell32.exe
File opened (read-only)	\??\r:	MSShell32.exe
File opened (read-only)	\??\g:	MSShell32.exe
File opened (read-only)	\??\m:	MSShell32.exe
File opened (read-only)	\??\n:	MSShell32.exe
File opened (read-only)	\??\p:	MSShell32.exe
File opened (read-only)	\??\q:	MSShell32.exe
File opened (read-only)	\??\u:	MSShell32.exe
File opened (read-only)	\??\v:	MSShell32.exe
File opened (read-only)	\??\w:	MSShell32.exe
File opened (read-only)	\??\z:	MSShell32.exe
File opened (read-only)	\??\h:	MSShell32.exe
File opened (read-only)	\??\x:	MSShell32.exe

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4864-0-0x0000000000400000-0x00000000004EF000-memory.dmp	autoit_exe
behavioral2/memory/4864-4-0x0000000000400000-0x00000000004EF000-memory.dmp	autoit_exe
behavioral2/files/0x0007000000023228-5.dat	autoit_exe
behavioral2/memory/4320-6-0x0000000000400000-0x00000000004EF000-memory.dmp	autoit_exe
behavioral2/memory/4320-14-0x0000000000400000-0x00000000004EF000-memory.dmp	autoit_exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\winmgmts:{impersonationLevel=impersonate}!\root\cimv2	MSShell32.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\localhost\root\SecurityCenter2	MSShell32.exe
File opened for modification	C:\Windows\SysWOW64\winmgmts:\root\CIMV2	MSShell32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1912	schtasks.exe
4288	schtasks.exe

Script User-Agent 4 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	70	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	50	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	51	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	69	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 1912	4864	be3f0baa13fecfbf44e07583e2351df7.exe	88
PID 4864 wrote to memory of 1912	4864	be3f0baa13fecfbf44e07583e2351df7.exe	88
PID 4864 wrote to memory of 1912	4864	be3f0baa13fecfbf44e07583e2351df7.exe	88
PID 4320 wrote to memory of 4288	4320	MSShell32.exe	99
PID 4320 wrote to memory of 4288	4320	MSShell32.exe	99
PID 4320 wrote to memory of 4288	4320	MSShell32.exe	99
PID 4320 wrote to memory of 2260	4320	MSShell32.exe	101
PID 4320 wrote to memory of 2260	4320	MSShell32.exe	101
PID 4320 wrote to memory of 2260	4320	MSShell32.exe	101

C:\Users\Admin\AppData\Local\Temp\be3f0baa13fecfbf44e07583e2351df7.exe
"C:\Users\Admin\AppData\Local\Temp\be3f0baa13fecfbf44e07583e2351df7.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn MSShell32 /tr "C:\Users\Admin\AppData\Roaming\MSShell32.exe"
  2⤵
  - Creates scheduled task(s)
  PID:1912

C:\Users\Admin\AppData\Roaming\MSShell32.exe
C:\Users\Admin\AppData\Roaming\MSShell32.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn MSShell32 /tr "C:\Users\Admin\AppData\Roaming\MSShell32.exe"
  2⤵
  - Creates scheduled task(s)
  PID:4288
- C:\Windows\SysWOW64\netsh.exe
  "C:\Windows\System32\netsh.exe" firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\MSShell32.exe" "MSShell32" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

1

T1562.004

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\MSShell32.exe

Filesize
911KB

MD5
be3f0baa13fecfbf44e07583e2351df7

SHA1
3989229062f1393bccac518002b4625445721063

SHA256
168b6fbe8b8f0fa03736eeec8e5e3b5a72c049700bfe847cd7050bc97f267649

SHA512
9c26974164d5b4f999dffa8c5f59a32dbd6bc868498f300d44e33c4aa32576aa190a25c0a761f6421857bfe934a9ea0d955d064034e2c7ad887ac0c5d6479de6

Download Submit
C:\Users\Admin\AppData\Roaming\MSShell32.ini

Filesize
15B

MD5
97a75a065383136b888da2884b84ceba

SHA1
000ba94c7d528ddfd9aebcbfe8e64abc672852e9

SHA256
46f6285ae622e0c180232e435ce0b43311c9f5b38ce43526160b993b734a3268

SHA512
37d0c532719e18cf21a237cf5a1dacf90c4a6a4f41ef125da2d1ac738f2b649eaa4f759e021d4d867248a0655c2396419ff806078e8ba3debab75acfe3c5ae4b

Download Submit
memory/4320-6-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4320-11-0x0000000002B70000-0x0000000002B71000-memory.dmp

Filesize
4KB

Download
memory/4320-12-0x0000000002B80000-0x0000000002B81000-memory.dmp

Filesize
4KB

Download
memory/4320-13-0x00000000033C0000-0x00000000033C1000-memory.dmp

Filesize
4KB

Download
memory/4320-14-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4864-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/4864-4-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads