1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8

General

Target
1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Size 3.2MB
Sample260809-cas4ha11ft
SHA256 1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8
MD5 fc9406f106d4f68660cbf8da82b1c7a7
SHA1 50d22eb30b655438588f9485db5c1a5ad55344f5
SHA512 8f31693363798c76308d2b370a794a73dcd1946caeeff66232e1cae0967cd78a27a9d4ca6ee3cdcc0604a9ecf817bcebed03df3c2b05ec4b1d96fdbd8e9b43b5
SSDEEP 49152:QhEWltMmiHmjssQK5NoM9jQbQQvZI2Ugq3lYm3JWxdzzwZXEMv4LEeyl:RIviGjZQK5BQbQQK2FvlsVvuEeg
TLSH
T163F5012337D18022E99505B0C9D8DA359ABADE220334CCB757D0FD486675D839E2E7EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4356	sg.tmp
5228	Explorer++_x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	Explorer++_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	Explorer++_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	Explorer++_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	Explorer++_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer++_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	Explorer++_x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	Explorer++_x64.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
5228	Explorer++_x64.exe
5228	Explorer++_x64.exe
5228	Explorer++_x64.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5228	Explorer++_x64.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeBackupPrivilege	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Token: SeRestorePrivilege	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Token: 33	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Token: SeIncBasePriorityPrivilege	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Token: 33	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Token: SeIncBasePriorityPrivilege	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Token: 33	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Token: SeIncBasePriorityPrivilege	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Token: SeRestorePrivilege	4356	sg.tmp
Token: 35	4356	sg.tmp
Token: SeSecurityPrivilege	4356	sg.tmp
Token: SeSecurityPrivilege	4356	sg.tmp
Token: 33	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
Token: SeIncBasePriorityPrivilege	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 2616	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe	88
PID 3124 wrote to memory of 4356	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe	90
PID 3124 wrote to memory of 5228	3124	1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe	92

C:\Users\Admin\AppData\Local\Temp\1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe
"C:\Users\Admin\AppData\Local\Temp\1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  - Executes a command shell one-liner
  PID:2616
- C:\Users\Admin\AppData\Local\Temp\~4273812412646856594~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\1612f4f88578a22e07be7fa65474b4030032eb61521a8fe7e9c4855adede08d8.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~1944886709371655492"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4356
- C:\Users\Admin\AppData\Local\Temp\~1944886709371655492\Explorer++_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\~1944886709371655492\Explorer++_x64.exe"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Explorer++_x64.exe

Path C:\Users\Admin\AppData\Local\Temp\~1944886709371655492\Explorer++_x64.exe
Size 5.7MB
SHA256 e1dbc0bc60515020e53d115a678c940aeb2c1d63604477b5463b8ea6b86c7066
MD5 6fd86cab9c5ea405e71bc29308fddd53
SHA1 2393be32a7e33ce1b517e0d382ba63c9c613d898
SHA512 cd9f465f7716dba90152f03371f2f0e505a0b9a3af9573ce435f5f5a96a40bc05e0db330b9d7b0c6c3bda0dc6762cefaebe3ab48d1a087b2db09cd89116a6d79
SSDEEP 98304:OAjBDEr0yJ5uNTAexliS6H4AaCRbzNnZH7twujlrX7S9v:OAjpEJRtFrL
TLSH
T118563807636900E8C0AA913AC567C932D672FC1603695AFB0260F2661F736E75E7E3DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~4273812412646856594~\sg.tmp
Size 834KB
SHA256 b6adaa8ec893d803a6c811c624231fd1facd8481f6b74eb01d443bef5b6755ca
MD5 0911c5fbadb30125649f033bb187349b
SHA1 17db8f07faa462470ff68f6222b146a7eae2abd6
SHA512 c0b851faefcca5c6d5930a8d8452505c48f68ad0b8f36f5c6cc952de0dd33dc6161bceb251f62336043a57f61b25d434510a61d12d3a35b9a0a73d11655a6a27
SSDEEP 24576:f36Ni6M0Eq9GcywpjWROjUGY3ID8bxC617Dc17p:fKobq9nypojUyD7F7
TLSH
T1D305AE127BE5D0BBD2421131CB1DABF591F993680B204CCB67948F5D7B309D1EA3AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5228-12-0x00007FFE98F30000-0x00007FFE98F40000-memory.dmp

Download

Analysis

Sharing