c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279

General

Target

c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe
Size

927KB
MD5

58425a8ca9e369e82233314c75ef0139
SHA1

bcb05f59c03514b0588e5da22e8fc45640bc1501
SHA256

c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279
SHA512

065e1553a279238ef0d4d9bcec451b4d84eb4db9f986460e318c3932b2b586ca61a3736d3062b99c86fb402ebb45b95f265e6efc26bfb2240ced54f522850f3e
SSDEEP

24576:WbN+yZe0p4Ek4niOkl/A04szE87JKTvmZ:WbN+ieW4SkZP4sz9Mba

Score

9^/10

Malware Config

Signatures

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral1/memory/2964-0-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/files/0x000c00000001444f-5.dat	UPX
behavioral1/memory/2964-14-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/2052-17-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/2816-15-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/2052-28-0x0000000000400000-0x000000000041B000-memory.dmp	UPX
behavioral1/memory/2816-27-0x0000000000400000-0x000000000041B000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

pid	Process
2816	MSWDM.EXE
2052	MSWDM.EXE
2564	C8C90743193EE35AC7C7379AA6DCFE20282150840BF3868D9EBD02B03E80F279.EXE

Loads dropped DLL 2 IoCs

pid	Process
2052	MSWDM.EXE
2052	MSWDM.EXE

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\devEEF.tmp	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe
File created	C:\WINDOWS\MSWDM.EXE	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2052	MSWDM.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2564	C8C90743193EE35AC7C7379AA6DCFE20282150840BF3868D9EBD02B03E80F279.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	2564	C8C90743193EE35AC7C7379AA6DCFE20282150840BF3868D9EBD02B03E80F279.EXE
Token: 35	2564	C8C90743193EE35AC7C7379AA6DCFE20282150840BF3868D9EBD02B03E80F279.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2816	2964	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe	28
PID 2964 wrote to memory of 2816	2964	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe	28
PID 2964 wrote to memory of 2816	2964	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe	28
PID 2964 wrote to memory of 2816	2964	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe	28
PID 2964 wrote to memory of 2052	2964	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe	29
PID 2964 wrote to memory of 2052	2964	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe	29
PID 2964 wrote to memory of 2052	2964	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe	29
PID 2964 wrote to memory of 2052	2964	c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe	29
PID 2052 wrote to memory of 2564	2052	MSWDM.EXE	30
PID 2052 wrote to memory of 2564	2052	MSWDM.EXE	30
PID 2052 wrote to memory of 2564	2052	MSWDM.EXE	30
PID 2052 wrote to memory of 2564	2052	MSWDM.EXE	30

C:\Users\Admin\AppData\Local\Temp\c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe
"C:\Users\Admin\AppData\Local\Temp\c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2964
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2816
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devEEF.tmp!C:\Users\Admin\AppData\Local\Temp\c8c90743193ee35ac7c7379aa6dcfe20282150840bf3868d9ebd02b03e80f279.exe! !
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Users\Admin\AppData\Local\Temp\C8C90743193EE35AC7C7379AA6DCFE20282150840BF3868D9EBD02B03E80F279.EXE
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\MSWDM.EXE

Filesize
80KB

MD5
f953eee07963c184dd80c54fe6d036a5

SHA1
c09ef25a25722b434f31e2e4ae9a53a77abfdb66

SHA256
58fe341cf6d3034c6b660f49e9619d7c9a189f1eca079e1aac0daf062d322fba

SHA512
4fb4d94008673a649f59e2e1971840d066f31808490ae8939f8d0c87995b39494a513c14ea3d8ed1966b13a268b80d923103bda27ff6c1dc64be938f1437fb95

Download Submit
C:\Windows\devEEF.tmp

Filesize
847KB

MD5
c8f40f25f783a52262bdaedeb5555427

SHA1
e45e198607c8d7398745baa71780e3e7a2f6deca

SHA256
e81b44ee7381ae3b630488b6fb7e3d9ffbdd9ac3032181d4ccaaff3409b57316

SHA512
f5944743f54028eb1dd0f2d68468726b177d33185324da0da96cdd20768bab4ca2e507ae9157b2733fd6240c920b7e15a5f5b9f284ee09d0fd385fc895b97191

Download Submit
memory/2052-17-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2052-28-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2816-15-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2816-27-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2964-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2964-6-0x0000000000420000-0x000000000043B000-memory.dmp

Filesize
108KB

Download
memory/2964-14-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads