c761f18e13595c727af11f7440e2f031f486a8dd4fac2cfba9082b2deca9b0c4

General

Target
loader.exe
Size 33KB
Sample260823-afb13agg89
SHA256 c761f18e13595c727af11f7440e2f031f486a8dd4fac2cfba9082b2deca9b0c4
MD5 148dc08d5217bf62d9e8c9e3ad5c7735
SHA1 906bee5f7dd5ad0aea9760b8087a1b205a13c25b
SHA512 357ac9764a991ab8019cc824a6353bebcfe8f5eae0fde22139fe2ed68a8d48d6cade7fc8ef7d63ff16b2a5b6ee66cff19a710a723e6e26727ae0146d04bfda44
SSDEEP 768:0sET7RmJuQ6ZzEG1o9IoZyiDsR/etEdFt8BjhBB:A9mJuVZ4aoTZyiDshetEdFtg
TLSH
T1EFF2098F738398EDC51AD178E4F78371E5B0FC6219345B3E4260D2361E38A949A7CA4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\spool\drivers\color\mscms.dll	loader.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4492	cmd.exe
3284	cmd.exe
4992	cmd.exe
1784	cmd.exe
4440	cmd.exe
3432	cmd.exe
1496	cmd.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocServer32	loader.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID	loader.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocServer32\ = "C:\\Windows\\System32\\spool\\drivers\\color\\mscms.dll"	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocServer32\ThreadingModel = "Apartment"	loader.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	whoami.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3432	4600	loader.exe	86
PID 3432 wrote to memory of 4732	3432	cmd.exe	87
PID 4600 wrote to memory of 1496	4600	loader.exe	88
PID 1496 wrote to memory of 4552	1496	cmd.exe	89
PID 4552 wrote to memory of 4612	4552	net.exe	90
PID 4600 wrote to memory of 4492	4600	loader.exe	92
PID 4492 wrote to memory of 4384	4492	cmd.exe	93
PID 4384 wrote to memory of 808	4384	net.exe	94
PID 4600 wrote to memory of 3284	4600	loader.exe	96
PID 3284 wrote to memory of 1608	3284	cmd.exe	97
PID 1608 wrote to memory of 2620	1608	net.exe	98
PID 4600 wrote to memory of 4992	4600	loader.exe	99
PID 4992 wrote to memory of 1156	4992	cmd.exe	100
PID 1156 wrote to memory of 892	1156	net.exe	101
PID 4600 wrote to memory of 1784	4600	loader.exe	103
PID 1784 wrote to memory of 3136	1784	cmd.exe	104
PID 4600 wrote to memory of 4440	4600	loader.exe	105

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rundll32.exe shell32.dll,SHCreateLocalServerRunDll {DCB00C01-570F-4A9B-8D69-199FDBA5723B}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\system32\rundll32.exe
    rundll32.exe shell32.dll,SHCreateLocalServerRunDll {DCB00C01-570F-4A9B-8D69-199FDBA5723B}
    3⤵
    PID:4732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop spooler > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Windows\system32\net.exe
    net stop spooler
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop spooler
      4⤵
      PID:4612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net start spooler > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\net.exe
    net start spooler
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start spooler
      4⤵
      PID:808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop wuauserv > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3284
- - C:\Windows\system32\net.exe
    net stop wuauserv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:2620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net start wuauserv > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\net.exe
    net start wuauserv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1156
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start wuauserv
      4⤵
      PID:892
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c whoami > C:\Windows\Temp\whoami.txt 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type C:\Windows\Temp\whoami.txt
  2⤵
  - Executes a command shell one-liner
  PID:4440

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

whoami.txt

Path C:\Windows\Temp\whoami.txt
Size 16B
SHA256 17fe36082c2e39cec44fc7d6df2c657c539e5add0cf1c24a6fed84926ae99c2a
MD5 bd9c038e377503ca8700ebb8f10d405e
SHA1 94a94ea94c99cbab3c18e39a785ee0727658f1e3
SHA512 a17546121f5e7ec37705a5978d786293d9bbd77adbe8cbcb887f4d09668bd90aa901bcfe705068c3977b7bfdae3271ab8bfed366139f1fc4bdccac979b4c9a52
MD5 SHA1 SHA512

Submit Download

memory/4600-4-0x00007FF62F1C0000-0x00007FF62F1CF000-memory.dmp

Download

Analysis

Sharing