7284bd27ed602a06f8f81318d3b43939f19ed61ebc13abf894abe77a10a65a72

General

Target

c5cb3d99a15b3ba1c954d70e68219d33.exe
Size

64KB
MD5

c5cb3d99a15b3ba1c954d70e68219d33
SHA1

dfbe56fb7c1cd5ae036a99a724c4a67d9738f360
SHA256

7284bd27ed602a06f8f81318d3b43939f19ed61ebc13abf894abe77a10a65a72
SHA512

043a253df221aa8bab236c6c5e7cb5c8b4fe878862e534cc1b9623ad73112b7851e40ee7d85d79a40c510e2f2c58c5334e6e7ee903c28f7cb882372e26997c3d
SSDEEP

768:hayWeFtHKeyEm3nNU5y5E2mtWCIC1Bvd/jnGwb66asOk:hayWotqeyEm3nstEaBvd/jnGwN

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe C:\\Windows\\System32\\subprnp.vbs"	c5cb3d99a15b3ba1c954d70e68219d33.exe

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	c5cb3d99a15b3ba1c954d70e68219d33.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	c5cb3d99a15b3ba1c954d70e68219d33.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	c5cb3d99a15b3ba1c954d70e68219d33.exe

Drops file in System32 directory 23 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\subprnp.vbs	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\sk0r_mailer.vbs	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\Winkernel32.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Family_surfin_with_childs.jpg.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Waterfall_in_autria.jpg.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\A very huge elephant!!.jpg.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File opened for modification	C:\Windows\SysWOW64\skpwisa.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File opened for modification	C:\Windows\SysWOW64\Winkernel32.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\prnmskv.vbs	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\skpwisa.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Mum and Dad chillin.jpg.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Battlefield 2 Crack.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\a_huge_dog_sitting_in_a_chair.jpg.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File opened for modification	C:\Windows\SysWOW64\msdriverdll32.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File opened for modification	C:\Windows\SysWOW64\prnmskv.vbs	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\my_own_picture_for_you.bmp.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Microsoft MSN Messenger 7 Plus.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Funny Game with Eggs.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Kaspersky AntiVirus Key !!working!!.reg.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\We_in_disneyland!.jpg.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\msdriverdll32.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\3787\Familien_Bilder_usw\Free Desktop Wallpaper.bmp.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\SysWOW64\subprnp.vbs	c5cb3d99a15b3ba1c954d70e68219d33.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Win32SkorInfo.html	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\Bestes_Bild.gif.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File opened for modification	C:\Windows\Bestes_Bild.gif.exe	c5cb3d99a15b3ba1c954d70e68219d33.exe
File created	C:\Windows\Win32SkorInfo.html	c5cb3d99a15b3ba1c954d70e68219d33.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	c5cb3d99a15b3ba1c954d70e68219d33.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.skorpay	c5cb3d99a15b3ba1c954d70e68219d33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.skorpay\massmailing = "mailed"	c5cb3d99a15b3ba1c954d70e68219d33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.skorpay\installed = "fertig"	c5cb3d99a15b3ba1c954d70e68219d33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.skorpay\counter = "1"	c5cb3d99a15b3ba1c954d70e68219d33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.skorpay\anfangwert = "sk0r"	c5cb3d99a15b3ba1c954d70e68219d33.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3348	c5cb3d99a15b3ba1c954d70e68219d33.exe
Token: SeSecurityPrivilege	3348	c5cb3d99a15b3ba1c954d70e68219d33.exe
Token: SeSecurityPrivilege	3348	c5cb3d99a15b3ba1c954d70e68219d33.exe
Token: SeSecurityPrivilege	3348	c5cb3d99a15b3ba1c954d70e68219d33.exe
Token: SeSecurityPrivilege	3348	c5cb3d99a15b3ba1c954d70e68219d33.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3348	c5cb3d99a15b3ba1c954d70e68219d33.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 4924	3348	c5cb3d99a15b3ba1c954d70e68219d33.exe	87
PID 3348 wrote to memory of 4924	3348	c5cb3d99a15b3ba1c954d70e68219d33.exe	87
PID 3348 wrote to memory of 4924	3348	c5cb3d99a15b3ba1c954d70e68219d33.exe	87

C:\Users\Admin\AppData\Local\Temp\c5cb3d99a15b3ba1c954d70e68219d33.exe
"C:\Users\Admin\AppData\Local\Temp\c5cb3d99a15b3ba1c954d70e68219d33.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Drops file in Drivers directory
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Windows\System32\sk0r_mailer.vbs"
  2⤵
  PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\3787\Familien_Bilder_usw\my_own_picture_for_you.bmp.exe

Filesize
64KB

MD5
c5cb3d99a15b3ba1c954d70e68219d33

SHA1
dfbe56fb7c1cd5ae036a99a724c4a67d9738f360

SHA256
7284bd27ed602a06f8f81318d3b43939f19ed61ebc13abf894abe77a10a65a72

SHA512
043a253df221aa8bab236c6c5e7cb5c8b4fe878862e534cc1b9623ad73112b7851e40ee7d85d79a40c510e2f2c58c5334e6e7ee903c28f7cb882372e26997c3d

Download Submit
C:\Windows\SysWOW64\sk0r_mailer.vbs

Filesize
1KB

MD5
27c83f8ab3341fc59fcd9e6eba507a47

SHA1
47321b4c36f5a49e9dbea5a554c0632fd123a2fa

SHA256
c68e6bf837caa02ab0108f3721eb402a7c34eee07473dd58f1e5b81a1d50db60

SHA512
51379e0cc512bfcd17b2076f53cc9e80b026d1cd8116c309baa049d71afe84347a0eb3aaaae0d77c133049c1e864668ca018e30e2c1f8f20b280d857eef1b989

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads