ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90

General

Target

ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe
Size

213KB
MD5

9f56c78b9409d1d1af7b9a7b996eca57
SHA1

664107f2d267ad84a5ab4a41bb142b2d460f081c
SHA256

ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90
SHA512

0d96b35c68a0af651f74fe8a24310f041b5a213f82fc4d86d431c25d7ecaf3d35813ba306e194fd2e4cb8da82e05bf3fa04e4cc909e43b3bec7621a91fac5824
SSDEEP

6144:ztvBPnU1b7e9SQii1EkoNlhlrQ2ZrM2xo:Zv1nWdQP1EDhZPxo

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3764	Isass.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Program Files (x86)\\Microsoft Build\\Isass.exe"	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isass.exe = "C:\\Program Files (x86)\\Microsoft Build\\Isass.exe"	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Build\Isass.exe	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
228	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe
228	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe
3764	Isass.exe
3764	Isass.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 3764	228	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe	90
PID 228 wrote to memory of 3764	228	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe	90
PID 228 wrote to memory of 3764	228	ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe	90

C:\Users\Admin\AppData\Local\Temp\ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe
"C:\Users\Admin\AppData\Local\Temp\ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files (x86)\Microsoft Build\Isass.exe
  "C:\Program Files (x86)\Microsoft Build\Isass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4076 --field-trial-handle=1928,i,13242902252791919845,10377620236057253993,262144 --variations-seed-version /prefetch:8
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Build\Isass.exe

Filesize
213KB

MD5
9f56c78b9409d1d1af7b9a7b996eca57

SHA1
664107f2d267ad84a5ab4a41bb142b2d460f081c

SHA256
ae5da10273738644c3c9eb3d73c1fa55c537a0fd56bd141f9c61d52c65018e90

SHA512
0d96b35c68a0af651f74fe8a24310f041b5a213f82fc4d86d431c25d7ecaf3d35813ba306e194fd2e4cb8da82e05bf3fa04e4cc909e43b3bec7621a91fac5824

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\setup.exe

Filesize
683KB

MD5
63f1f6e0f70994476aa3f38783ce1e99

SHA1
07b3f2ab07eb7812fb7c767e20947c855eaec36b

SHA256
e35d0c3c340b494bd91a09bbd4232f4ab0bd526e7ea0fe31f9076cdf6f25f4c8

SHA512
860f8b8cc934d22b2a6d594081cdb5d2bf2eb40c709d6573026ed042befa0a7312c6948d2cf5eb091d4f166fc6161b047286928d7e0cadab020d858e87e3b26f

Download Submit
memory/228-9-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/228-1-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/228-2-0x0000000001990000-0x0000000001991000-memory.dmp

Filesize
4KB

Download
memory/228-0-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-13-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-16-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-11-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-12-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-8-0x0000000001840000-0x0000000001841000-memory.dmp

Filesize
4KB

Download
memory/3764-14-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-15-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-10-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-19-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-20-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-7-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-30-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-35-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-38-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-39-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download
memory/3764-40-0x0000000000400000-0x00000000016A7000-memory.dmp

Filesize
18.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads