cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750

General

Target

cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
Size

1013KB
MD5

1743b703e18d0803cbe9181ad9a41c6f
SHA1

9ae83b191b15cc3aa52f252d1cca2b7c11c01200
SHA256

cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750
SHA512

9faa4fde10f68bb1946a1fc1ebc5143ee6153ac3bd1e532e616d8fceb431bfec19576bfc2a43310bfe8153e22cde93641e2ef439aa4c71d5f2ceef45604921c9
SSDEEP

24576:QRmJkcoQricOIQxiZY1iaAOTy/zPDCWdjNnMK8:lJZoQrbTFZY1iaAmy/jMn

Score

10^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lsass.exe"	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MSWUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lsass.exe"	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MSWUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lsass.exe"	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
720	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
4956	lsass.exe
5004	lsass.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lsass.exe"	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lsass.exe"	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000a000000023c55-16.dat	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3176 set thread context of 4580	3176	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	82
PID 4956 set thread context of 5004	4956	lsass.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lsass.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
720	netsh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4580	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
5004	lsass.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3176 wrote to memory of 4580	3176	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	82
PID 3176 wrote to memory of 4580	3176	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	82
PID 3176 wrote to memory of 4580	3176	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	82
PID 3176 wrote to memory of 4580	3176	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	82
PID 3176 wrote to memory of 4580	3176	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	82
PID 4580 wrote to memory of 720	4580	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	83
PID 4580 wrote to memory of 720	4580	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	83
PID 4580 wrote to memory of 720	4580	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	83
PID 4580 wrote to memory of 4956	4580	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	85
PID 4580 wrote to memory of 4956	4580	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	85
PID 4580 wrote to memory of 4956	4580	cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe	85
PID 4956 wrote to memory of 5004	4956	lsass.exe	90
PID 4956 wrote to memory of 5004	4956	lsass.exe	90
PID 4956 wrote to memory of 5004	4956	lsass.exe	90
PID 4956 wrote to memory of 5004	4956	lsass.exe	90
PID 4956 wrote to memory of 5004	4956	lsass.exe	90

C:\Users\Admin\AppData\Local\Temp\cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
"C:\Users\Admin\AppData\Local\Temp\cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3176
- C:\Users\Admin\AppData\Local\Temp\cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
  C:\Users\Admin\AppData\Local\Temp\cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="ImgBurn" dir=in action=allow description="Multimedia suite" program="C:\Users\Admin\AppData\Roaming\Microsoft\lsass.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - System Time Discovery
    PID:720
- - C:\Users\Admin\AppData\Roaming\Microsoft\lsass.exe
    /k C:\Users\Admin\AppData\Local\Temp\cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4956
  - - C:\Users\Admin\AppData\Roaming\Microsoft\lsass.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\lsass.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

T1547.001

Winlogon Helper DLL

1

T1547.004

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Event Triggered Execution

1

T1546

Netsh Helper DLL

1

T1546.007

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Time Discovery

1

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\camp23.dat

Filesize
208KB

MD5
588d50fd76475949ef4f5639f931553d

SHA1
b367a727d3208514b5003b75f44e97cd110df068

SHA256
91c410febced91640648dadce6d4d2c06217ea219672dfcbe2e322ce166420bc

SHA512
8d30f1d54b7cb1889b7e0826e56780a2def1429eb41094d07b7d63ca0aaeddfd7915e7f982c2576194536e4a107a940482a9440f395fdac3cf8b32f9bd6f4ae7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\PKlEfelgJliWU.tmp

Filesize
18KB

MD5
99a5ced9dfb5824225a0fab4c74a7b46

SHA1
f0ebed42f94fabe0c10dcf1eb3eb084a904e144a

SHA256
44b3cbfb57079b2570e5ae94942d8e00ce0291c26317c2649a41101018bab25a

SHA512
2966164e08f60aaa0078dbfee9f4d5521b5c02525dbbad4ac14df0d6be948ba98ae1da33e05ceec07abd6d8a18278c399629621803acdccc91019372fa3152ce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\lsass.exe

Filesize
1013KB

MD5
1743b703e18d0803cbe9181ad9a41c6f

SHA1
9ae83b191b15cc3aa52f252d1cca2b7c11c01200

SHA256
cc47723541af26a118739c5a9b464ae8a11f8581bd659c09feee2fff2f16a750

SHA512
9faa4fde10f68bb1946a1fc1ebc5143ee6153ac3bd1e532e616d8fceb431bfec19576bfc2a43310bfe8153e22cde93641e2ef439aa4c71d5f2ceef45604921c9

Download Submit
memory/4580-8-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4580-10-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/4580-20-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-51-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-53-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-56-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-59-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/5004-62-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads