ae02d2cec500812aaf0109c35f1421765ea0eebfbb8de26b9c7c2933dd97dd77

General

Target

wpe.exe
Size

56KB
MD5

77ed29c8348379d43ecb9e841d64f6b6
SHA1

14f53a4d5f4a3cc8cd8f2040e28401aa4b9e8c1e
SHA256

fb62a5da456ee9a0f90fe48c3fa57c09d7d4f30bc7cdebee45f6dda02ccf34e6
SHA512

2db27ee4ff7afda5670adf58f7465a5c4f9ee63cefacad5c973660866b6cda62a67f69587ab0497f1ab017548225fff827d90187b031d5b8681557fc61b5a962
SSDEEP

768:J4JPHOF3W8nMIbk6KQVEs8rA7FYM9M6Ap9riiJ:J4Jf83W8W60IL26Ap8iJ

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

wpe.exeFun.exeSVIQ.EXEdc.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe"	wpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe"	Fun.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe"	SVIQ.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe"	dc.exe

Executes dropped EXE 3 IoCs

Processes:

Fun.exeSVIQ.EXEdc.exe

pid process

3456 Fun.exe
1688 SVIQ.EXE
4864 dc.exe

pid	process
3456	Fun.exe
1688	SVIQ.EXE
4864	dc.exe

Adds Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

SVIQ.EXEdc.exewpe.exeFun.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE"	SVIQ.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE"	dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe"	wpe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe"	dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe"	SVIQ.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe"	SVIQ.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe"	dc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE"	wpe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE"	Fun.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe"	wpe.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe"	Fun.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe"	Fun.exe

Drops file in System32 directory 12 IoCs

Processes:

wpe.exeFun.exedc.exeSVIQ.EXE

description	ioc	process
File created	C:\Windows\SysWOW64\config\Win.exe	wpe.exe
File opened for modification	C:\Windows\SysWOW64\config\Win.exe	wpe.exe
File opened for modification	C:\Windows\SysWOW64\WinSit.exe	Fun.exe
File opened for modification	C:\Windows\SysWOW64\config\Win.exe	Fun.exe
File opened for modification	C:\Windows\SysWOW64\config\Win.exe	dc.exe
File opened for modification	C:\Windows\SysWOW64\Penx.dat	Fun.exe
File created	C:\Windows\SysWOW64\WinSit.exe	wpe.exe
File opened for modification	C:\Windows\SysWOW64\WinSit.exe	wpe.exe
File opened for modification	C:\Windows\SysWOW64\WinSit.exe	dc.exe
File opened for modification	C:\Windows\SysWOW64\Xpen.dat	Fun.exe
File opened for modification	C:\Windows\SysWOW64\WinSit.exe	SVIQ.EXE
File opened for modification	C:\Windows\SysWOW64\config\Win.exe	SVIQ.EXE

Drops file in Windows directory 34 IoCs

Processes:

wpe.exeFun.exedc.exeSVIQ.EXE

description	ioc	process
File opened for modification	C:\Windows\system\Fun.exe	wpe.exe
File created	C:\Windows\SVIQ.EXE	wpe.exe
File opened for modification	C:\Windows\wininit.ini	Fun.exe
File created	C:\Windows\SVIQ.EXE	dc.exe
File opened for modification	C:\Windows\inf\Other.exe	dc.exe
File created	C:\Windows\Help\Other.exe	wpe.exe
File opened for modification	C:\Windows\system\Fun.exe	dc.exe
File opened for modification	C:\Windows\dc.exe	wpe.exe
File opened for modification	C:\Windows\inf\Other.exe	SVIQ.EXE
File opened for modification	C:\Windows\wininit.ini	dc.exe
File opened for modification	C:\Windows\system\Fun.exe	SVIQ.EXE
File opened for modification	C:\Windows\dc.exe	dc.exe
File created	C:\Windows\dc.exe	wpe.exe
File opened for modification	C:\Windows\SVIQ.EXE	wpe.exe
File created	C:\Windows\system\Fun.exe	Fun.exe
File created	C:\Windows\system\Fun.exe	SVIQ.EXE
File opened for modification	C:\Windows\system\Fun.exe	Fun.exe
File created	C:\Windows\system\Fun.exe	wpe.exe
File opened for modification	C:\Windows\wininit.ini	wpe.exe
File opened for modification	C:\Windows\Help\Other.exe	Fun.exe
File created	C:\Windows\SVIQ.EXE	SVIQ.EXE
File opened for modification	C:\Windows\wininit.ini	SVIQ.EXE
File created	C:\Windows\dc.exe	dc.exe
File created	C:\Windows\inf\Other.exe	wpe.exe
File opened for modification	C:\Windows\inf\Other.exe	wpe.exe
File opened for modification	C:\Windows\Help\Other.exe	wpe.exe
File opened for modification	C:\Windows\SVIQ.EXE	Fun.exe
File opened for modification	C:\Windows\inf\Other.exe	Fun.exe
File opened for modification	C:\Windows\dc.exe	SVIQ.EXE
File created	C:\Windows\system\Fun.exe	dc.exe
File opened for modification	C:\Windows\dc.exe	Fun.exe
File opened for modification	C:\Windows\Help\Other.exe	dc.exe
File opened for modification	C:\Windows\Help\Other.exe	SVIQ.EXE
File opened for modification	C:\Windows\SVIQ.exe	SVIQ.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

wpe.exeFun.exeSVIQ.EXEdc.exe

pid	process
924	wpe.exe
924	wpe.exe
924	wpe.exe
924	wpe.exe
3456	Fun.exe
3456	Fun.exe
1688	SVIQ.EXE
1688	SVIQ.EXE
4864	dc.exe
4864	dc.exe
3456	Fun.exe
3456	Fun.exe
1688	SVIQ.EXE
1688	SVIQ.EXE
4864	dc.exe
4864	dc.exe
924	wpe.exe
924	wpe.exe
3456	Fun.exe
3456	Fun.exe
1688	SVIQ.EXE
1688	SVIQ.EXE
4864	dc.exe
4864	dc.exe
3456	Fun.exe
3456	Fun.exe
1688	SVIQ.EXE
1688	SVIQ.EXE
4864	dc.exe
4864	dc.exe
3456	Fun.exe
3456	Fun.exe
1688	SVIQ.EXE
1688	SVIQ.EXE
4864	dc.exe
4864	dc.exe
3456	Fun.exe
3456	Fun.exe
1688	SVIQ.EXE
1688	SVIQ.EXE
4864	dc.exe
4864	dc.exe
3456	Fun.exe
3456	Fun.exe
1688	SVIQ.EXE
1688	SVIQ.EXE
4864	dc.exe
4864	dc.exe
3456	Fun.exe
1688	SVIQ.EXE
3456	Fun.exe
1688	SVIQ.EXE
4864	dc.exe
4864	dc.exe
3456	Fun.exe
1688	SVIQ.EXE
3456	Fun.exe
1688	SVIQ.EXE
4864	dc.exe
4864	dc.exe
3456	Fun.exe
1688	SVIQ.EXE
3456	Fun.exe
1688	SVIQ.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

wpe.exeFun.exeSVIQ.EXEdc.exe

pid process

924 wpe.exe
924 wpe.exe
3456 Fun.exe
3456 Fun.exe
1688 SVIQ.EXE
1688 SVIQ.EXE
4864 dc.exe
4864 dc.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

wpe.exeFun.exe

description	pid	process	target process
PID 924 wrote to memory of 3456	924	wpe.exe	Fun.exe
PID 924 wrote to memory of 3456	924	wpe.exe	Fun.exe
PID 924 wrote to memory of 3456	924	wpe.exe	Fun.exe
PID 3456 wrote to memory of 1688	3456	Fun.exe	SVIQ.EXE
PID 3456 wrote to memory of 1688	3456	Fun.exe	SVIQ.EXE
PID 3456 wrote to memory of 1688	3456	Fun.exe	SVIQ.EXE
PID 924 wrote to memory of 4864	924	wpe.exe	dc.exe
PID 924 wrote to memory of 4864	924	wpe.exe	dc.exe
PID 924 wrote to memory of 4864	924	wpe.exe	dc.exe

C:\Users\Admin\AppData\Local\Temp\wpe.exe
"C:\Users\Admin\AppData\Local\Temp\wpe.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:924

C:\Windows\system\Fun.exe
C:\Windows\system\Fun.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3456

C:\Windows\SVIQ.EXE
C:\Windows\SVIQ.EXE
3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1688

C:\Windows\dc.exe
C:\Windows\dc.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SVIQ.EXE

Filesize
56KB

MD5
77ed29c8348379d43ecb9e841d64f6b6

SHA1
14f53a4d5f4a3cc8cd8f2040e28401aa4b9e8c1e

SHA256
fb62a5da456ee9a0f90fe48c3fa57c09d7d4f30bc7cdebee45f6dda02ccf34e6

SHA512
2db27ee4ff7afda5670adf58f7465a5c4f9ee63cefacad5c973660866b6cda62a67f69587ab0497f1ab017548225fff827d90187b031d5b8681557fc61b5a962

Download Submit
C:\Windows\wininit.ini

Filesize
41B

MD5
e839977c0d22c9aa497b0b1d90d8a372

SHA1
b5048e501399138796b38f3d3666e1a88c397e83

SHA256
478db7f82fd7ef4860f7acd2f534ec303175500d7f4e1e36161d31c900d234e2

SHA512
4c8ba5a26b6f738f8d25c32d019cee63e9a32d28e3aeb8fe31b965d7603c24a3539e469c8eb569747b47dadc9c43cdd1066ddb37ed8138bee5d0c74b5d0c275d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads