ae0e11a13ffa7d349b3fbd4e1966d25a5a339b164ed6cc87bbf8da76abde8866

General

Target

Patch Fix.exe
Size

1.0MB
MD5

0b44f548d340e9275d94971241bb8f7a
SHA1

f33be25f3f0e471e9e65613e0493cf1900b22422
SHA256

ae0e11a13ffa7d349b3fbd4e1966d25a5a339b164ed6cc87bbf8da76abde8866
SHA512

633629ea7a8a64dc00560bc3e1ed5de25ca234cdadabfcc83ac52e779464c72035111332c11162ddf2a971660c915b3e7eced02c132f07788cc5d46e73dfb577
SSDEEP

24576:aNxY7AJDq1S1pOefXNV8PYabTFSlPZFfk4:aNxvtXOefb8xleR7

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe	cmd.exe

Executes dropped EXE 1 IoCs

Processes:

Chrome.exe

pid process

3740 Chrome.exe

pid	process
3740	Chrome.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Chrome.exe"	reg.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

4804 PING.EXE
2372 PING.EXE
1780 PING.EXE

pid	process
4804	PING.EXE
2372	PING.EXE
1780	PING.EXE

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

Patch Fix.exeChrome.exe

pid	process
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3948	Patch Fix.exe
3740	Chrome.exe
3740	Chrome.exe
3740	Chrome.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Patch Fix.exeChrome.exe

description pid process

Token: SeDebugPrivilege 3948 Patch Fix.exe
Token: SeDebugPrivilege 3740 Chrome.exe

description	pid	process
Token: SeDebugPrivilege	3948	Patch Fix.exe
Token: SeDebugPrivilege	3740	Chrome.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

Patch Fix.execmd.execmd.exe

description	pid	process	target process
PID 3948 wrote to memory of 1932	3948	Patch Fix.exe	cmd.exe
PID 3948 wrote to memory of 1932	3948	Patch Fix.exe	cmd.exe
PID 3948 wrote to memory of 1932	3948	Patch Fix.exe	cmd.exe
PID 1932 wrote to memory of 2372	1932	cmd.exe	PING.EXE
PID 1932 wrote to memory of 2372	1932	cmd.exe	PING.EXE
PID 1932 wrote to memory of 2372	1932	cmd.exe	PING.EXE
PID 3948 wrote to memory of 4112	3948	Patch Fix.exe	cmd.exe
PID 3948 wrote to memory of 4112	3948	Patch Fix.exe	cmd.exe
PID 3948 wrote to memory of 4112	3948	Patch Fix.exe	cmd.exe
PID 4112 wrote to memory of 1780	4112	cmd.exe	PING.EXE
PID 4112 wrote to memory of 1780	4112	cmd.exe	PING.EXE
PID 4112 wrote to memory of 1780	4112	cmd.exe	PING.EXE
PID 1932 wrote to memory of 556	1932	cmd.exe	reg.exe
PID 1932 wrote to memory of 556	1932	cmd.exe	reg.exe
PID 1932 wrote to memory of 556	1932	cmd.exe	reg.exe
PID 4112 wrote to memory of 4804	4112	cmd.exe	PING.EXE
PID 4112 wrote to memory of 4804	4112	cmd.exe	PING.EXE
PID 4112 wrote to memory of 4804	4112	cmd.exe	PING.EXE
PID 4112 wrote to memory of 3740	4112	cmd.exe	Chrome.exe
PID 4112 wrote to memory of 3740	4112	cmd.exe	Chrome.exe
PID 4112 wrote to memory of 3740	4112	cmd.exe	Chrome.exe

C:\Users\Admin\AppData\Local\Temp\Patch Fix.exe
"C:\Users\Admin\AppData\Local\Temp\Patch Fix.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 37 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Chrome" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 37
3⤵
- Runs ping.exe
PID:2372

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "Chrome" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe"
3⤵
- Adds Run key to start application
PID:556

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 44 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Patch Fix.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe" && ping 127.0.0.1 -n 44 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe"
2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:4112

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 44
3⤵
- Runs ping.exe
PID:1780

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 44
3⤵
- Runs ping.exe
PID:4804

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3740

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Chrome.exe
Filesize
1.0MB

MD5
0b44f548d340e9275d94971241bb8f7a

SHA1
f33be25f3f0e471e9e65613e0493cf1900b22422

SHA256
ae0e11a13ffa7d349b3fbd4e1966d25a5a339b164ed6cc87bbf8da76abde8866

SHA512
633629ea7a8a64dc00560bc3e1ed5de25ca234cdadabfcc83ac52e779464c72035111332c11162ddf2a971660c915b3e7eced02c132f07788cc5d46e73dfb577

Download Submit
memory/3740-21-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3740-19-0x0000000074620000-0x0000000074DD0000-memory.dmp

Filesize
7.7MB

Download
memory/3740-20-0x0000000000C00000-0x0000000000D0A000-memory.dmp

Filesize
1.0MB

Download
memory/3948-8-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3948-5-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3948-6-0x00000000068C0000-0x0000000006904000-memory.dmp

Filesize
272KB

Download
memory/3948-7-0x0000000006A60000-0x0000000006A6A000-memory.dmp

Filesize
40KB

Download
memory/3948-0-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/3948-9-0x000000007465E000-0x000000007465F000-memory.dmp

Filesize
4KB

Download
memory/3948-10-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3948-11-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3948-13-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3948-4-0x00000000054C0000-0x0000000005552000-memory.dmp

Filesize
584KB

Download
memory/3948-3-0x00000000059D0000-0x0000000005F74000-memory.dmp

Filesize
5.6MB

Download
memory/3948-2-0x0000000005350000-0x00000000053EC000-memory.dmp

Filesize
624KB

Download
memory/3948-1-0x0000000000FE0000-0x00000000010EA000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads