a46d2fc44f4fdba3a0bbcc3bf69acd2d2f3dfc1c66086e6b8c9086b42220601d

General

Target
PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Size 1.1MB
Sample260519-14bcjsfx3k
SHA256 a46d2fc44f4fdba3a0bbcc3bf69acd2d2f3dfc1c66086e6b8c9086b42220601d
MD5 f2574b87fc9978413948e227f65c1974
SHA1 03bfd44d0f5f9b89f446008b7a3d5898fbc0ff75
SHA512 33dc604a469a67acfdc05d599dce864d1f0f3e9183663f5d9dc4f8991f722384b8fb0ddfab4d0670189a596469b4ec68383f8e8ac5891c42d9a7fa35e5a4f22b
SSDEEP 24576:f2mXg+IRAnm6djMMndx8PSgQXxVpbFwHyy9sEzC3vfLWH6NN/qF:fDg+UAnAMdK6geho2XVNN/o
TLSH
T1F545335883FC2B11DDAF4F366521806D0D366723DF3D97BC08CCA596A9F660E9831E89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\Registry\User\.DEFAULT\Volatile Environment	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\VOLATILE ENVIRONMENT\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\CloudFiles	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\VOLATILE ENVIRONMENT\windir = "C:\\Users\\Admin\\AppData\\Local\\Temp"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key created	\Registry\User\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps\SymbolicLinkValue = "\\Registry\\User\\.DEFAULT\\Volatile Environment"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key created	\REGISTRY\USER\.DEFAULT\VOLATILE ENVIRONMENT	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key created	\REGISTRY\USER\.DEFAULT\VOLATILE ENVIRONMENT\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\VOLATILE ENVIRONMENT\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92\Enabled = "1"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92\Enabled = "1"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\VOLATILE ENVIRONMENT\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92\ImagePath = "\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\PoC_AbortHydration_ArbitraryRegKey_EoP.exe"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\CloudFiles\BlockedApps\81ffc028d96e2bd24e33366da6e26e95294b52928f5377356538ae73f56ad92\ImagePath = "\\Device\\HarddiskVolume2\\Users\\Admin\\AppData\\Local\\Temp\\PoC_AbortHydration_ArbitraryRegKey_EoP.exe"	PoC_AbortHydration_ArbitraryRegKey_EoP.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5624	PoC_AbortHydration_ArbitraryRegKey_EoP.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 5772	3608	PoC_AbortHydration_ArbitraryRegKey_EoP.exe	81
PID 3608 wrote to memory of 5932	3608	PoC_AbortHydration_ArbitraryRegKey_EoP.exe	82
PID 3608 wrote to memory of 5624	3608	PoC_AbortHydration_ArbitraryRegKey_EoP.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\PoC_AbortHydration_ArbitraryRegKey_EoP.exe
"C:\Users\Admin\AppData\Local\Temp\PoC_AbortHydration_ArbitraryRegKey_EoP.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Users\Admin\AppData\Local\Temp\PoC_AbortHydration_ArbitraryRegKey_EoP.exe
  run 1
  2⤵
  - Modifies data under HKEY_USERS
  PID:5772
- C:\Users\Admin\AppData\Local\Temp\PoC_AbortHydration_ArbitraryRegKey_EoP.exe
  run 2
  2⤵
  - Modifies data under HKEY_USERS
  PID:5932
- C:\Users\Admin\AppData\Local\Temp\PoC_AbortHydration_ArbitraryRegKey_EoP.exe
  run 3
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PoC_AbortHydration_ArbitraryRegKey_EoP.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PoC_AbortHydration_ArbitraryRegKey_EoP.exe.log
Size 425B
SHA256 d9bdf6a2bfdd9b2b5c8593de17ade3d8d317dad331aa6ca0da7483dd06db1140
MD5 de75c43a265d0848584ae05945570edf
SHA1 69f95177914f8d8b2f278a91f585a0024b8dffd3
SHA512 365f29c693dd7aa2ade092d765a96f20bf1f7fa93bca7f3b25aeddf5700817b9fd388e8f7d9f1b781c8a876739b06ad16d61e7ed08a1c85ac4be4686a38c63bc
TLSH
T1EFE0683133A1A1D988573F83295C678D53BF43196650FE08B994225ED82902B6F313E3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3608-0-0x000002C3664C0000-0x000002C3665EC000-memory.dmp

Download

memory/3608-1-0x000002C368410000-0x000002C368420000-memory.dmp

Download

memory/3608-2-0x000002C36A110000-0x000002C36A3CA000-memory.dmp

Download

memory/5624-7-0x000001E226100000-0x000001E226158000-memory.dmp

Download

memory/5772-3-0x0000016225750000-0x0000016225760000-memory.dmp

Download

memory/5932-6-0x0000019EFBC50000-0x0000019EFBC60000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads