26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2

General

Target

26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
Size

292KB
MD5

0f455b470891006dc8921d5474a5abe7
SHA1

d2ad40a773b9b20141d8ee22d6b3c77372713b35
SHA256

26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2
SHA512

0a49448f0587bea9e9eef4aac49b8ac78bd1a41f5599c02580d6f6b941ec079b7510c7e4b01de657f00cc50058361c7f28dd59aafbc98d55169c182552b0d680
SSDEEP

768:jZKM11gG4ChfiPO0rfz0shcUypMC5/VKhZyg3iepFV2DIQqSsFY2s/qsy/EI0IQR:gMDgG4ChfiPOefgsOUqQwg

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Syssrc32 = "C:\\Windows\\Syssrc32.exe"	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fndfst32 = "C:\\Windows\\System\\fndfst32.exe"	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Explorer Shell = "C:\\Windows\\System\\Explorer.exe"	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System applets = "C:\\Windows\\System\\applets.exe"	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System\Sysexp32.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File created	C:\Windows\System\applets.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File opened for modification	C:\Windows\System\Explorer.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File opened for modification	C:\Windows\Syssrc32.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File created	C:\Windows\Syssrc32.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File created	C:\Windows\System\Sysexp32.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File created	C:\Windows\System\mplayerw.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File opened for modification	C:\Windows\System\applets.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File created	C:\Windows\System\fndfst32.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File created	C:\Windows\System\Explorer.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File opened for modification	C:\Windows\Help\intret.cnt	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File created	C:\Windows\Help\intret.cnt	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File opened for modification	C:\Windows\System\mplayerw.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
File opened for modification	C:\Windows\System\fndfst32.exe	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2604	2332	WerFault.exe	27

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\Explore = "%SystemRoot%\\SysWow64\\NOTEPAD.EXE %1"	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\System\\Sysexp32.exe %1"	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 2604	2332	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe	28
PID 2332 wrote to memory of 2604	2332	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe	28
PID 2332 wrote to memory of 2604	2332	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe	28
PID 2332 wrote to memory of 2604	2332	26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe	28

C:\Users\Admin\AppData\Local\Temp\26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe
"C:\Users\Admin\AppData\Local\Temp\26003668989f33dbedd2ca68595fb7d9908efeb93054096d0402f4ceee2677f2.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 92
  2⤵
  - Program crash
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\system\Sysexp32.exe

Filesize
304KB

MD5
3768e5235f343b2f060486820449c214

SHA1
ed49fefb4905a05e1a76f55cba4fb02511a0500e

SHA256
57cc983b79418158a5653a44b95c2fbc31a180f1c7e9724189e67fadf3534a23

SHA512
619f03e4b02c64d319e23271854b2887d493cd0142f7fc867fc113d0a09529607929ab6c4c2091727fe3cd03200745bc2563629e563fe4c998987efc013429df

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads