95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3

General

Target
95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
Size 511KB
Sample260416-1ln6paew21
SHA256 95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3
MD5 c3098f224f2b339afd4af51d093ba4b0
SHA1 f458c96b1f21c93e1efde7527845a70266ec3405
SHA512 c82689de6f08639113cc4af6225c6de3d675ee6cbbcf9bfe39dc4742f2d34a047a4fc95c0f496169ab38cff819ac5130f0db9a249e00b1288f74e2052c385532
SSDEEP 6144:tFcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:zSvO2x9mONvKRILSFnOkx2LIax5F0
TLSH
T1B1B45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4632	4d345bcf

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
Destination IP	4	223.5.5.5	3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
Destination IP	26	114.114.114.114	3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
Destination IP	27	223.5.5.5	3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\4d345bcf	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	4d345bcf
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	4d345bcf
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	4d345bcf
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	4d345bcf

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\4f4d30	4d345bcf
File opened for modification	C:\Windows\440088	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4d345bcf

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	4d345bcf
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	4d345bcf
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	4d345bcf
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	4d345bcf
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	4d345bcf
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	4d345bcf
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	4d345bcf
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	4d345bcf
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	4d345bcf

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4632	4d345bcf
4632	4d345bcf
4632	4d345bcf
4632	4d345bcf
4632	4d345bcf
4632	4d345bcf
4632	4d345bcf
4632	4d345bcf
4632	4d345bcf
4632	4d345bcf
4632	4d345bcf
4632	4d345bcf
3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
Token: SeTcbPrivilege	3972	95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
Token: SeDebugPrivilege	4632	4d345bcf
Token: SeTcbPrivilege	4632	4d345bcf

C:\Users\Admin\AppData\Local\Temp\95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe
"C:\Users\Admin\AppData\Local\Temp\95aa2a96781cf1fb7a85643da0b4693c3b24aaddb353b22f624986645ce3fdd3.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\Syswow64\4d345bcf
C:\Windows\Syswow64\4d345bcf
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4d345bcf

Path C:\Windows\SysWOW64\4d345bcf
Size 511KB
SHA256 f37181674702a403e62bd0dd41cabd2712c049b77b9930784a3fece54ed38b1e
MD5 4f110d4fba7db834a27c8d76e1293d43
SHA1 882bfb89678fe4b33ff3bb08ad2ef49515931245
SHA512 7a04b9253cd1ed105607ca04706e20e83d161121b6cac9e5a0a3c6baf1643e3980337e3a5f8674fbf8f5ee318f35f7db364bb3b1418ad662b74739f6498cacfd
SSDEEP 6144:JcTgav1cdCTuoPbgwmOLJvKRILSFvdFDcEOkCybEaQRXr9HNdvOax5Rv0:JSvO2x9mONvKRILSFnOkx2LIax5F0
TLSH
T19FB45C26F6908036C4B34575C5F64BAAFAB4BC21631156CBA3943A6A1F737D2BD3130E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3972-0-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/3972-19-0x0000000002870000-0x00000000028CF000-memory.dmp

Download

memory/4632-4-0x0000000000400000-0x0000000000463000-memory.dmp

Download

memory/4632-12-0x00000000019A0000-0x00000000019FF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads