10ce0d68893d8cb5a87bb13f3f5bb482ebb52d76283a2c5b6828ffc0fa89e8e5

General

Target
stage1.exe
Size 64.4MB
Sample260801-ld7kqsgp7x
SHA256 10ce0d68893d8cb5a87bb13f3f5bb482ebb52d76283a2c5b6828ffc0fa89e8e5
MD5 75e00f68998c1902b945c04c0745991f
SHA1 0d2453ae982c1318cec3bdfee120b99196fc9cb4
SHA512 7e3038327a960955babf6d8d62c5bd2bb6573adf7cf5dc019185a97a6f7ece9f11afcf2cf1508ffc3644de32da672ab360722f046dfe94639b11b9c62d2d68c3
SSDEEP 393216:zj/9zVIML9NFyIH9HGy8OJu83y3lZs/Y4Yg6glb/vG5L5OtsFtuNTa3nbRNn1JJ5:NuML9D38OA83yg1Yg1WV5OtsFktaPx5
TLSH
T17FE7AE15B3D80A16E63FC27CC2638102E7F1B4931352D7CF4558EA992F63BC1AA77266
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
612	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
4	5480	stage1.exe

Executes dropped EXE 2 IoCs

pid	Process
5408	svchost.exe
5668	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\a31a19a0\\svchost.exe"	stage1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2944	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
924	timeout.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\shell\open\command	stage1.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings	stage1.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\shell	stage1.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\shell\open	stage1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\a31a19a0\\svchost.exe"	stage1.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	calc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	calc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\shell\open\command	stage1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\ms-settings\shell\open\command\DelegateExecute	stage1.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
612	powershell.exe
612	powershell.exe
612	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5480 wrote to memory of 4320	5480	stage1.exe	90
PID 5480 wrote to memory of 260	5480	stage1.exe	91
PID 260 wrote to memory of 5684	260	calc.exe	92
PID 4320 wrote to memory of 5408	4320	fodhelper.exe	93
PID 5408 wrote to memory of 3416	5408	svchost.exe	95
PID 5668 wrote to memory of 480	5668	svchost.exe	96
PID 3416 wrote to memory of 1204	3416	calc.exe	97
PID 480 wrote to memory of 1948	480	calc.exe	98
PID 5480 wrote to memory of 2944	5480	stage1.exe	99
PID 2944 wrote to memory of 924	2944	cmd.exe	101
PID 5668 wrote to memory of 612	5668	svchost.exe	103

C:\Users\Admin\AppData\Local\Temp\stage1.exe
"C:\Users\Admin\AppData\Local\Temp\stage1.exe"
1⤵
- Downloads MZ/PE file
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5480
- C:\Windows\System32\fodhelper.exe
  "C:\Windows\System32\fodhelper.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Users\Admin\AppData\Local\a31a19a0\svchost.exe
    "C:\Users\Admin\AppData\Local\a31a19a0\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5408
  - - C:\Windows\System32\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3416
    - - C:\Windows\System32\win32calc.exe
        
        "C:\Windows\System32\win32calc.exe"
        5⤵
        
        PID:1204
- C:\Windows\SYSTEM32\calc.exe
  "calc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:260
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:5684
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\cleanup.bat"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:924

C:\Users\Admin\AppData\Local\a31a19a0\svchost.exe
C:\Users\Admin\AppData\Local\a31a19a0\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5668
- C:\Windows\System32\calc.exe
  "C:\Windows\System32\calc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:480
- - C:\Windows\System32\win32calc.exe
    "C:\Windows\System32\win32calc.exe"
    3⤵
    PID:1948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $w=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width; $h=[System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height; $b=New-Object System.Drawing.Bitmap($w,$h); $g=[System.Drawing.Graphics]::FromImage($b); $g.CopyFromScreen(0,0,0,0,$b.Size); $b.Save('C:\Users\Admin\AppData\Local\Temp\ss_76ef47bc0901.png'); $b.Dispose(); $g.Dispose()"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

1

T1059.001

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cleanup.bat

Path C:\Users\Admin\AppData\Local\Temp\cleanup.bat
Size 242B
SHA256 de68bb7e6469ea0359cc7aa933e6da3ead795ee0026ee7d66b8f8d86c83e5f06
MD5 079fc2f334fbe568cac8b3f0c91d4da0
SHA1 71e35e3dcb9c59e1239742c6a6b905e765317c87
SHA512 18a896fd48c2bc0c87029cd550f4b2b02c8797abd7ad13ee02a2066b82467186021e7fee7cd05019a7ac9f566b40a10bba62b58de30237e7859c7b29731bb083
TLSH
T19CD0A707218F8BAD080050B70ABF108DE0B9081A3F89B7D14751C06E578782EE7E37C5
MD5 SHA1 SHA512 TLSH

Submit Download

ss_76ef47bc0901.png

Path C:\Users\Admin\AppData\Local\Temp\ss_76ef47bc0901.png
Size 489KB
SHA256 5dbca1d31b84e145f4a6814ba2698b35da36d9b8abfa35a9e54801ba4b2f3e76
MD5 4528cfa16fd740933350d6e0fe9213a4
SHA1 172beb116c9131a5dcb0d15e364476526eea7c19
SHA512 827ed3c7d14dea17d3cfc3af2d93e2926eb42789003914293c270445c5731c5aca552ba2668f9e376c70c2c6ec79cc5ba30da04ab24d91765ed381df4dcd7ef0
SSDEEP 12288:kclloObVlgNscp/M7qYKob/FrfXVj3R4bBQQt2:kEOyrUp01/zRIBQQt2
TLSH
T1A8B4220DA1F7910E9CCC23B79A34598B07A4E2BF93E5083D14943689EC11E7EF593B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/612-16-0x0000026EE7590000-0x0000026EE75B2000-memory.dmp

Download

memory/612-19-0x0000026EE7950000-0x0000026EE7B1A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads