69b71a7d045a84ebf362385e256e5b23e2eae6135081b2aafcf783854a0f50b9

General

Target

d3dcbfe17278f06298c64b5e0f616ec3.exe
Size

634KB
MD5

d3dcbfe17278f06298c64b5e0f616ec3
SHA1

be3b2c3747e746f2b6cbcd0ddf4da0ff38499cab
SHA256

69b71a7d045a84ebf362385e256e5b23e2eae6135081b2aafcf783854a0f50b9
SHA512

dc68149d7a03e24ee6c9fcec9adb6efa9df63e235ca826740598e43d328e1a93aa643bc0bf20937c3817deb52f23dc7d19389d3c02fdb777bbc0ae17ca8806de
SSDEEP

6144:IooZIFH5nlz1gL5pRTMTTjMkId/BynSx7dEe6XwzRaktNP08NhKs39zo43fTtl1I:ISF1l1gL5pRTcAkS/3hzN8qE43fm78Vc

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
296	MSWDM.EXE
2356	MSWDM.EXE
2072	D3DCBFE17278F06298C64B5E0F616EC3.EXE
2596	MSWDM.EXE

Loads dropped DLL 2 IoCs

pid	Process
296	MSWDM.EXE
2656	Process not Found

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	d3dcbfe17278f06298c64b5e0f616ec3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	d3dcbfe17278f06298c64b5e0f616ec3.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	d3dcbfe17278f06298c64b5e0f616ec3.exe
File opened for modification	C:\Windows\dev1EC7.tmp	d3dcbfe17278f06298c64b5e0f616ec3.exe
File opened for modification	C:\Windows\dev1EC7.tmp	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
296	MSWDM.EXE

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2356	2864	d3dcbfe17278f06298c64b5e0f616ec3.exe	28
PID 2864 wrote to memory of 2356	2864	d3dcbfe17278f06298c64b5e0f616ec3.exe	28
PID 2864 wrote to memory of 2356	2864	d3dcbfe17278f06298c64b5e0f616ec3.exe	28
PID 2864 wrote to memory of 2356	2864	d3dcbfe17278f06298c64b5e0f616ec3.exe	28
PID 2864 wrote to memory of 296	2864	d3dcbfe17278f06298c64b5e0f616ec3.exe	29
PID 2864 wrote to memory of 296	2864	d3dcbfe17278f06298c64b5e0f616ec3.exe	29
PID 2864 wrote to memory of 296	2864	d3dcbfe17278f06298c64b5e0f616ec3.exe	29
PID 2864 wrote to memory of 296	2864	d3dcbfe17278f06298c64b5e0f616ec3.exe	29
PID 296 wrote to memory of 2072	296	MSWDM.EXE	30
PID 296 wrote to memory of 2072	296	MSWDM.EXE	30
PID 296 wrote to memory of 2072	296	MSWDM.EXE	30
PID 296 wrote to memory of 2072	296	MSWDM.EXE	30
PID 296 wrote to memory of 2596	296	MSWDM.EXE	32
PID 296 wrote to memory of 2596	296	MSWDM.EXE	32
PID 296 wrote to memory of 2596	296	MSWDM.EXE	32
PID 296 wrote to memory of 2596	296	MSWDM.EXE	32

C:\Users\Admin\AppData\Local\Temp\d3dcbfe17278f06298c64b5e0f616ec3.exe
"C:\Users\Admin\AppData\Local\Temp\d3dcbfe17278f06298c64b5e0f616ec3.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2864
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2356
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev1EC7.tmp!C:\Users\Admin\AppData\Local\Temp\d3dcbfe17278f06298c64b5e0f616ec3.exe! !
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:296
- - C:\Users\Admin\AppData\Local\Temp\D3DCBFE17278F06298C64B5E0F616EC3.EXE
    3⤵
    - Executes dropped EXE
    PID:2072
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev1EC7.tmp!C:\Users\Admin\AppData\Local\Temp\D3DCBFE17278F06298C64B5E0F616EC3.EXE!
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\D3DCBFE17278F06298C64B5E0F616EC3.EXE

Filesize
634KB

MD5
e81c5891d6172cabf00ff9fac5d6dd3c

SHA1
885663b819ab5287e3f6ecb1658eb9b5439c701a

SHA256
3bbeb87126595e75879672e61cbe2d42d9e197f19d915117c1b187aff5084b84

SHA512
59a96b2c00f46fedf65658cb12a1eb9aeefddbeb59cd50e346427b748c8fdaf8de5a476848864fa51295a0b999f534fa8ece7f6e93d0574f2178ddaaf2b6847a

Download Submit
C:\Users\Admin\AppData\Local\Temp\d3dcbfe17278f06298c64b5e0f616ec3.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Windows\MSWDM.EXE

Filesize
176KB

MD5
8a351d3a4fdac918dccdbcb21c60b59c

SHA1
bdf5b7d41c4d62fbb23f71e9d7f7a4b9d7c4815a

SHA256
7c5d7b0369ef97f79d2a0492f2fc9f1e784f3f3317bd375c03bf0bf071673c95

SHA512
761a6aa05f6cf9892b839069eb298a5d3eec0e2e9dc0b287f05c38c984c388b7ce1e4adf9f371afabf342b3b38ba8814492eab3da2421597589f88ff338f2d2a

Download Submit
memory/296-19-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/296-30-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/296-23-0x0000000000290000-0x00000000002BC000-memory.dmp

Filesize
176KB

Download
memory/2356-20-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2356-31-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2596-28-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2864-0-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/2864-11-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads