3d362b120c197f0fa7a2acac0318b49ed67ea1ed4aa3dfac34b213e02f7606ed

General

Target

PPPOE095.exe
Size

126KB
MD5

e3e3eaf898d672e48d0758e075daf0c3
SHA1

384a7a741d539b887f99f2fae711037ee507cd0c
SHA256

b4f5f2c6a7f2f05ec32279f623861bb5a6f7fbbac44696601d995c23e21be37f
SHA512

0fdad5b535dcdd04a52070d80a94158cc8d92e282f99691e24875a420f6139e80d809f44f9f387422d4d470ce65e533ac7c3c8d8b84502436334549445e04c32
SSDEEP

1536:SNsf9oCmhzvH9B646+x9/ebOOlRK/B0VSe8oN9JJGGQeHfpt05aGBe6:hZmhzPr64VenUB0VSLojJJGAHv1Gk6

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
648	RASPPPOE.EXE

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\Temp\{ca682e46-074b-f24a-a2f8-a4252761fcfe}\SET75DC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ca682e46-074b-f24a-a2f8-a4252761fcfe}\NETPPPOE.INF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ca682e46-074b-f24a-a2f8-a4252761fcfe}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{ca682e46-074b-f24a-a2f8-a4252761fcfe}\SET75DC.tmp	DrvInst.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	RASPPPOE.EXE
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Checks SCSI registry key(s) 3 TTPs 10 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeAuditPrivilege	2616	svchost.exe
Token: SeSecurityPrivilege	2616	svchost.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 648	3848	PPPOE095.exe	82
PID 3848 wrote to memory of 648	3848	PPPOE095.exe	82
PID 3848 wrote to memory of 648	3848	PPPOE095.exe	82
PID 2616 wrote to memory of 2756	2616	svchost.exe	90
PID 2616 wrote to memory of 2756	2616	svchost.exe	90

C:\Users\Admin\AppData\Local\Temp\PPPOE095.exe
"C:\Users\Admin\AppData\Local\Temp\PPPOE095.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\RSPE5767.TMP\RASPPPOE.EXE
  RASPPPOE.EXE
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:648

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3d693f9d-91fa-3842-93f6-8f5282ab64b7}\NETPPPOE.INF" "9" "4f9efc093" "0000000000000154" "WinSta0\Default" "00000000000000E8" "208" "C:\Users\Admin\AppData\Local\Temp\RSPE5767.TMP"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RSPE5767.TMP\NETPPPOE.INF

Filesize
3KB

MD5
eee998903dad88e02eb7b194af44ea42

SHA1
2352d36d3a50a8cedd97670bcdc7bde703fcd62e

SHA256
4db87e6c6d48ecf666bd12fff65b4d56a0da52939bf68c2e0c1b4f992910f8c1

SHA512
e4a6c504cb5824cefe8332665d3aa158ff092eaa094c925ea094c0a05d21c6f292dc7bf97242d4e096ac4aa66b2261b8d935ad953349ea0e93bcf6d49a725cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\RSPE5767.TMP\RASPPPOE.EXE

Filesize
26KB

MD5
778102445ce21089b28ca9919c268b90

SHA1
2a7c65fbb43bfa6bb0972e81cda7f7fa42586559

SHA256
bbaa88b64e94b12386efcf7cb6346921960a174722cee40e59d97dad855ae7d2

SHA512
a63a77aa5f4ce83507c35724e40d12fc2b37e1be0002dda3b9f2eeec92302bd830dc222dda1b41863954ee1a237d5cfaa4446dc7fda70609ae4f361b86e6be45

Download Submit

Analysis

Sharing