a46d2fc44f4fdba3a0bbcc3bf69acd2d2f3dfc1c66086e6b8c9086b42220601d

General

Target
PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Size 1.1MB
Sample260519-14bcjsfx3k
SHA256 a46d2fc44f4fdba3a0bbcc3bf69acd2d2f3dfc1c66086e6b8c9086b42220601d
MD5 f2574b87fc9978413948e227f65c1974
SHA1 03bfd44d0f5f9b89f446008b7a3d5898fbc0ff75
SHA512 33dc604a469a67acfdc05d599dce864d1f0f3e9183663f5d9dc4f8991f722384b8fb0ddfab4d0670189a596469b4ec68383f8e8ac5891c42d9a7fa35e5a4f22b
SSDEEP 24576:f2mXg+IRAnm6djMMndx8PSgQXxVpbFwHyy9sEzC3vfLWH6NN/qF:fDg+UAnAMdK6geho2XVNN/o
TLSH
T1F545335883FC2B11DDAF4F366521806D0D366723DF3D97BC08CCA596A9F660E9831E89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Volatile Environment\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92\Enabled = "1"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key created	\Registry\User\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Volatile Environment\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92\ImagePath = "\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\PoC_AbortHydration_ArbitraryRegKey_EoP.exe"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps\SymbolicLinkValue = "\\Registry\\User\\.DEFAULT\\Volatile Environment"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Volatile Environment\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92\Enabled = "1"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Volatile Environment\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\CloudFiles	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key created	\Registry\User\.DEFAULT\Volatile Environment	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Volatile Environment\windir = "C:\\Users\\Admin\\AppData\\Local\\Temp"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92\ImagePath = "\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\PoC_AbortHydration_ArbitraryRegKey_EoP.exe"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2744	PoC_AbortHydration_ArbitraryRegKey_EoP.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4344	3980	PoC_AbortHydration_ArbitraryRegKey_EoP.exe	88
PID 3980 wrote to memory of 784	3980	PoC_AbortHydration_ArbitraryRegKey_EoP.exe	91
PID 3980 wrote to memory of 2744	3980	PoC_AbortHydration_ArbitraryRegKey_EoP.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PoC_AbortHydration_ArbitraryRegKey_EoP.exe
"C:\Users\Admin\AppData\Local\Temp\PoC_AbortHydration_ArbitraryRegKey_EoP.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Users\Admin\AppData\Local\Temp\PoC_AbortHydration_ArbitraryRegKey_EoP.exe
  run 1
  2⤵
  - Modifies data under HKEY_USERS
  PID:4344
- C:\Users\Admin\AppData\Local\Temp\PoC_AbortHydration_ArbitraryRegKey_EoP.exe
  run 2
  2⤵
  - Modifies data under HKEY_USERS
  PID:784
- C:\Users\Admin\AppData\Local\Temp\PoC_AbortHydration_ArbitraryRegKey_EoP.exe
  run 3
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PoC_AbortHydration_ArbitraryRegKey_EoP.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PoC_AbortHydration_ArbitraryRegKey_EoP.exe.log
Size 425B
SHA256 b8f7e4ed81764db56b9c09050f68c5a26af78d8a5e2443e75e0e1aa7cd2ccd76
MD5 fff5cbccb6b31b40f834b8f4778a779a
SHA1 899ed0377e89f1ed434cfeecc5bc0163ebdf0454
SHA512 1a188a14c667bc31d2651b220aa762be9cce4a75713217846fbe472a307c7bbc6e3c27617f75f489902a534d9184648d204d03ee956ac57b11aa90551248b8f9
TLSH
T15CE0AB702261E2D449023F54280D2A8443BF4729A620DE083494629FD8311230F212E7
MD5 SHA1 SHA512 TLSH

Analysis

Sharing