4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62

General

Target
4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Size 5.0MB
Sample260506-vycersfs7w
SHA256 4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62
MD5 5afcb69ac9a55efe3c1c9c05632dfc17
SHA1 5a4999b035f4f87786d4207cb48905b9e1aa8907
SHA512 cdb82d4ee8970a3da551924d1c6f264f381cdd6b843a90b1ee0e2f2c85d7bd9951bfee6a10956a4ffbcd0bb79277e8dfc2f5d9e77198add48489bb3eb9d8a230
SSDEEP 98304:UJyDPruaLZ9wF7AF5vQW1cjg07/mdoOsBhOMJ9gfg:2aL/wF7ALpdo7J9Y
TLSH
T1B036BF11FA8080B2E5A3013982BAA77B897DBD301724C5C763E42D7A4E716D17B3E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\ScOkWMLAV.sys	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
File created	C:\Windows\System32\drivers\JhxI7e9g.sys	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe

Sets service image path in registry 3 TTPs 2 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScOkWMLAV\ImagePath = "system32\\DRIVERS\\ScOkWMLAV.sys"	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\JhxI7e9g\ImagePath = "system32\\DRIVERS\\JhxI7e9g.sys"	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe

Executes dropped EXE 2 IoCs

pid	Process
4812	F2DC.tmp
4868	F32B.tmp

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
4448	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
4448	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4448	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Token: SeShutdownPrivilege	4448	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Token: SeDebugPrivilege	4448	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Token: SeDebugPrivilege	4812	F2DC.tmp
Token: SeDebugPrivilege	4448	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Token: SeLoadDriverPrivilege	4448	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
Token: SeDebugPrivilege	4868	F32B.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 4812	4448	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe	80
PID 4448 wrote to memory of 4868	4448	4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe	81

C:\Users\Admin\AppData\Local\Temp\4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe
"C:\Users\Admin\AppData\Local\Temp\4c4729cef79540554bee8cc0bdd8655bd1d47fe2aa53d0f9b7716acde8749c62.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\F2DC.tmp
  "C:\Users\Admin\AppData\Local\Temp\F2DC.tmp" 648
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Users\Admin\AppData\Local\Temp\F32B.tmp
  "C:\Users\Admin\AppData\Local\Temp\F32B.tmp" 668
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F2DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\F2DC.tmp
Size 463KB
SHA256 6c5e14139c01e04463d52552f0df1825eec6e8d2a0e17ba22e7afc7f422e097f
MD5 e45bfd0dda871f2ed899b1b9f39a1727
SHA1 358ee512209152e9ccf12583b200429d5dfba2f8
SHA512 eb7949dbd27fb5b2bab95e16f39f9b83c7e6f30c900fbb9f71a4f8fe22719a6ffd6b1ef5d66eaf1979bce304d9f200a2233c2b1f1ebf2528fe76a4052b6067fb
SSDEEP 12288:zeq98eSx5cA1zXpDm649VCClXyctmS5V2NDZuFxk/:b9Fka8Xpe9VCClXyctmS5V2N9uFxk/
TLSH
T130A48CD5779009F9D177C23CC9920A16E6B27826076097CF03B496BA1F237E29E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4448-0-0x00000000000D0000-0x00000000005FD000-memory.dmp

Download

memory/4448-13-0x0000000001810000-0x0000000001874000-memory.dmp

Download

memory/4812-5-0x0000028F7CDC0000-0x0000028F7D138000-memory.dmp

Download

memory/4868-11-0x000001BDFF600000-0x000001BDFF978000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads