f5a5ca7fedb0ffe06945b1574a913d2dbc114bc56073be9214d884d79f967bd9

General

Target

8cf9aaaa59aa894bdfd166fd72d915d1edd92d272d2deeabf66477b07e04a34c.exe
Size

334KB
MD5

17e6d3f8d752b3f5da51ffe1b2b8243b
SHA1

082fded31ae80a75ca98ad8a539db39599de01a1
SHA256

8cf9aaaa59aa894bdfd166fd72d915d1edd92d272d2deeabf66477b07e04a34c
SHA512

4483e3fbeb039007f619bd7e2dbf0906774aaf69209bfdba14608f77179d6d29a5077dd54759b1f8c37072259cab4784773ba0ddf606746a2b3b5e7db387bb6e
SSDEEP

6144:jMs0cJIggjOgD97HnJu+ImuJo323h3j76QBHl/2pUNgic9yL6w/DGQTqu:Is0ISjOgD97HJuau+2RhBHlepUV3L3

Score

8^/10

persistence upx

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\z8T8H\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\11cI8wvg.dll"	8cf9aaaa59aa894bdfd166fd72d915d1edd92d272d2deeabf66477b07e04a34c.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\z8T8H\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k z8T8H"	8cf9aaaa59aa894bdfd166fd72d915d1edd92d272d2deeabf66477b07e04a34c.exe

Deletes itself 1 IoCs

pid	Process
2540	svchost.exe

Loads dropped DLL 1 IoCs

pid	Process
2540	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1564-0-0x00007FF7347C0000-0x00007FF7347EF000-memory.dmp	upx
behavioral2/memory/1564-6-0x00007FF7347C0000-0x00007FF7347EF000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\1696593118415[1].zip	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\91[1].txt	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2540	svchost.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\qQeokav\	svchost.exe
File created	\??\c:\windows\qQeokav\V4t2M.zip	svchost.exe
File opened for modification	\??\c:\windows\qQeokav\V4t2M.zip	svchost.exe
File created	\??\c:\windows\qQeokav\3s1B.txt	svchost.exe
File created	\??\c:\windows\5OD5oF5	8cf9aaaa59aa894bdfd166fd72d915d1edd92d272d2deeabf66477b07e04a34c.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe

C:\Users\Admin\AppData\Local\Temp\8cf9aaaa59aa894bdfd166fd72d915d1edd92d272d2deeabf66477b07e04a34c.exe
"C:\Users\Admin\AppData\Local\Temp\8cf9aaaa59aa894bdfd166fd72d915d1edd92d272d2deeabf66477b07e04a34c.exe"
1⤵
- Sets DLL path for service in the registry
- Sets service image path in registry
- Drops file in Windows directory
PID:1564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k z8T8H -s z8T8H
1⤵
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\qQeokav\V4t2M.zip

Filesize
1.6MB

MD5
9c6e749f9122f77c05919a17d6b37ca0

SHA1
1fb3072bae282223a989e7bb5ab3ede75571cc50

SHA256
d712725f98de47fc5f5b02543245b841fab5e8a8e5fdc2d9e5e26af1cdfd5cc7

SHA512
0b9f9530caeb7f4ab3d161c09a8edb82ace9c3499008b309131cf5af01780b1ff799b05be6a0a4be5321303168af5c1d7796ed9b2b08e999d80ef26d75f7994d

Download Submit
\??\c:\users\admin\appdata\local\temp\11ci8wvg.dll

Filesize
477KB

MD5
077ad748218b67ff1e10fc343c14d311

SHA1
c9959758fd76b5456010ba23f1ba607b37fe314c

SHA256
fa557ebf9080a92751f845fb20e6ace06376920e49aab3b9a03e32e34e75e748

SHA512
6b3a653a8a74bb966e751a02e71fcf1f6224cfc2c0857464cf45007c8c64a5d7d34d847b61095721836969bfd4c41c152cbb153db7ad212d891345b740ed3034

Download Submit
memory/1564-0-0x00007FF7347C0000-0x00007FF7347EF000-memory.dmp

Filesize
188KB

Download
memory/1564-6-0x00007FF7347C0000-0x00007FF7347EF000-memory.dmp

Filesize
188KB

Download
memory/2540-8-0x00007FF986ED0000-0x00007FF986F52000-memory.dmp

Filesize
520KB

Download
memory/2540-9-0x00007FF986ED0000-0x00007FF986F52000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads