080043f373cb48ed2c239e886c7498d648ec1bc3d8e5789d6ff4ed191c1c2cee

General

Target
080043f373cb48ed2c239e886c7498d648ec1bc3d8e5789d6ff4ed191c1c2cee.exe
Size 750KB
Sample260706-m289xaas2j
SHA256 080043f373cb48ed2c239e886c7498d648ec1bc3d8e5789d6ff4ed191c1c2cee
MD5 39b7d23c20c5eabd61c058f3c22450b0
SHA1 235e73ad3a85950247b030f4de03f4b306cfd9ac
SHA512 3f0520ef8ffacefb354a11b8c3696a18cfe278994295dc514c25ab5d11fe6a3c1ef427c92b650c8114ba9c58b26c6f62debb3a57b8a1dfd9b2adce4bed5020f7
SSDEEP 12288:7qm7QAQnXr9FdmRL8iz2Cezors3YRunntQ+7QXyprMljMvsj//CKdy48iy5LH5C:7q/rwRw9CwRtZ7Lpr2ovyCYl8i6LZC
TLSH
T1EDF4121FB2ED30F5E6768334C81145AAE37674354B61AEAF07A04B684F37190AE2EF15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File opened for modification	C:\Windows\Tasks\SA.DAT	svchost.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2656	sc.exe
4532	sc.exe
5856	sc.exe
2796	sc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5740	cmd.exe
5920	PING.EXE

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5844	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msdtc.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	msdtc.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
5920	PING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5844	taskkill.exe
Token: SeAuditPrivilege	4900	svchost.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5620 wrote to memory of 4348	5620	080043f373cb48ed2c239e886c7498d648ec1bc3d8e5789d6ff4ed191c1c2cee.exe	88
PID 5620 wrote to memory of 2824	5620	080043f373cb48ed2c239e886c7498d648ec1bc3d8e5789d6ff4ed191c1c2cee.exe	89
PID 5620 wrote to memory of 5740	5620	080043f373cb48ed2c239e886c7498d648ec1bc3d8e5789d6ff4ed191c1c2cee.exe	90
PID 4348 wrote to memory of 2796	4348	cmd.exe	94
PID 4348 wrote to memory of 2656	4348	cmd.exe	95
PID 2824 wrote to memory of 3048	2824	cmd.exe	96
PID 5740 wrote to memory of 5920	5740	cmd.exe	97
PID 3048 wrote to memory of 4532	3048	cmd.exe	99
PID 3048 wrote to memory of 2636	3048	cmd.exe	100
PID 2824 wrote to memory of 5844	2824	cmd.exe	101
PID 5740 wrote to memory of 5856	5740	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\080043f373cb48ed2c239e886c7498d648ec1bc3d8e5789d6ff4ed191c1c2cee.exe
"C:\Users\Admin\AppData\Local\Temp\080043f373cb48ed2c239e886c7498d648ec1bc3d8e5789d6ff4ed191c1c2cee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5620
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c sc stop msdtc | sc start msdtc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4348
- - C:\Windows\system32\sc.exe
    sc stop msdtc
    3⤵
    - Launches sc.exe
    PID:2796
- - C:\Windows\system32\sc.exe
    sc start msdtc
    3⤵
    - Launches sc.exe
    PID:2656
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c "for /f "tokens=2 delims=: " %i in ('sc queryex Schedule ^| findstr PID') do taskkill /PID %i /F "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c sc queryex Schedule | findstr PID
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3048
  - - C:\Windows\system32\sc.exe
      sc queryex Schedule
      4⤵
      Launches sc.exe
      PID:4532
  - - C:\Windows\system32\findstr.exe
      findstr PID
      4⤵
      PID:2636
- - C:\Windows\system32\taskkill.exe
    taskkill /PID 1676 /F
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5844
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c ping 127.0.0.1 && sc start Schedule
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:5920
- - C:\Windows\system32\sc.exe
    sc start Schedule
    3⤵
    - Launches sc.exe
    PID:5856

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Credential Access

Discovery

Remote System Discovery

1

T1018

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

SA.DAT

Path C:\Windows\Tasks\SA.DAT
Size 6B
SHA256 12dc5ccd7fecafe070976a1916e9672e3d53085633c86957aee305ccc584184c
MD5 f1a6cd5adaab953a6764ea364e17bfb8
SHA1 c99a1eb2d8974a667d2e0bc2dc1efcbe0ef23387
SHA512 da8cc20e0c0f48a975f97fc133ba4e99de6771163465d03f1cc0e3019fedfe0afa99799b9e343610a941218b19c9117b12e4ab86911d04c2908b6db44523e84c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing