69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411

General

Target

69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe
Size

701KB
MD5

5890798f97f9144206499433a5db3011
SHA1

1c9c488123a81bf8d2216ac57c089e056f899433
SHA256

69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411
SHA512

964f340060a67abed11d06ac40cb8cb2577f985e8815cc12f306e37a716792ae8edac02645d0cddeea5d81f72ef402363c909b6f510eb2a37c76f1cf56caada9
SSDEEP

6144:57A/MmghsENIsRctX5rUvQSNj0LZOWM8yucn:5U/Mv0rU1Nj0LZOd8yus

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1620 set thread context of 2764	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	33

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3044	explorer.exe
Token: SeShutdownPrivilege	3044	explorer.exe
Token: SeShutdownPrivilege	3044	explorer.exe
Token: SeShutdownPrivilege	3044	explorer.exe
Token: SeShutdownPrivilege	3044	explorer.exe
Token: SeShutdownPrivilege	3044	explorer.exe
Token: SeShutdownPrivilege	3044	explorer.exe
Token: SeShutdownPrivilege	3044	explorer.exe
Token: SeShutdownPrivilege	3044	explorer.exe
Token: SeShutdownPrivilege	3044	explorer.exe
Token: SeShutdownPrivilege	3044	explorer.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe
3044	explorer.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1620 wrote to memory of 3044	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	30
PID 1620 wrote to memory of 3044	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	30
PID 1620 wrote to memory of 3044	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	30
PID 1620 wrote to memory of 3044	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	30
PID 3044 wrote to memory of 1860	3044	explorer.exe	31
PID 3044 wrote to memory of 1860	3044	explorer.exe	31
PID 3044 wrote to memory of 1860	3044	explorer.exe	31
PID 1620 wrote to memory of 2764	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	33
PID 1620 wrote to memory of 2764	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	33
PID 1620 wrote to memory of 2764	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	33
PID 1620 wrote to memory of 2764	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	33
PID 1620 wrote to memory of 2764	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	33
PID 1620 wrote to memory of 2764	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	33
PID 1620 wrote to memory of 2764	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	33
PID 1620 wrote to memory of 2764	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	33
PID 1620 wrote to memory of 2764	1620	69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe
"C:\Users\Admin\AppData\Local\Temp\69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:1860
- C:\Users\Admin\AppData\Local\Temp\69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe
  "C:\Users\Admin\AppData\Local\Temp\69be5428a0e939a5bf4453b34aad1a86791ab75411b6a339d727197f82bc8411.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1620-16-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/1620-1-0x00000000009C0000-0x0000000000A76000-memory.dmp

Filesize
728KB

Download
memory/1620-2-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/1620-0-0x0000000073F1E000-0x0000000073F1F000-memory.dmp

Filesize
4KB

Download
memory/2764-14-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2764-15-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2764-13-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2764-12-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2764-6-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2764-10-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2764-4-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3044-20-0x0000000002A40000-0x0000000002A50000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads