3a54eee619f4f4b3ffb476b5e77a06ee7c32ef9c0ccc7406dcac5e724b34c8af

General

Target
Aurora.exe
Size 155KB
Sample260912-wsfexasare
SHA256 3a54eee619f4f4b3ffb476b5e77a06ee7c32ef9c0ccc7406dcac5e724b34c8af
MD5 e0689b7c6ad5f546e21230b1bf31a113
SHA1 53860dde1ac70df87457981964360d5255fc901f
SHA512 5e159a595da7fec015cd05ad7bf1efeca2b0e40b312afddd473d101826c35449fbe1a8a09b9fdda02f5c88c53246d86b3b93cd653f30a1997d3194c807ec6ab0
SSDEEP 3072:s8KZQHjWatUHkh5i7/zOE714qebJ2J1nn/uy:JKQDWSh55e1/
TLSH
T164F32A5BB3A530F9E0B7C279C9920606F772B87157609B9F07A0427A1F272D0DD3AB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	1728	Aurora.exe

Executes dropped EXE 2 IoCs

pid	Process
3884	Aurora15Connector.exe
5216	Aurora15Connector.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl	svchost.exe
File opened for modification	C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT	svchost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3884	Aurora15Connector.exe
Token: SeShutdownPrivilege	428	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2560	SecHealthUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 3884	1728	Aurora.exe	86
PID 3884 wrote to memory of 5216	3884	Aurora15Connector.exe	87

C:\Users\Admin\AppData\Local\Temp\Aurora.exe
"C:\Users\Admin\AppData\Local\Temp\Aurora.exe"
1⤵
- Downloads MZ/PE file
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Aurora15Connector\bootstrap\1.1.79-63D0D7A9C054ACC66717A756EF82935B99453B3F9A5C96C52975A93AAD851B99\Aurora15Connector.exe
  "C:\Users\Admin\AppData\Local\Aurora15Connector\bootstrap\1.1.79-63D0D7A9C054ACC66717A756EF82935B99453B3F9A5C96C52975A93AAD851B99\Aurora15Connector.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Users\Admin\AppData\Local\Aurora15Connector\Aurora15Connector.exe
    "C:\Users\Admin\AppData\Local\Aurora15Connector\Aurora15Connector.exe" --launcher-update-probe --ready-file C:\Users\Admin\AppData\Local\Aurora15Connector\updates\update-16d0dee0283f49f185aa2a1e8999ba4e\launcher-afd39a40558a4d8f834d9922b2a4bde8.ready --ready-token 1792208300D7ECB920C44FAB8B85DCF7D3E152CF91B35BB2477BFFE2850BE26A --expected-sha256 8FEED168C8D7054A8CEF1BD33076FF2608F6CAFE33991171F6ABACE1B024C2A4 --expected-length 14718464
    3⤵
    - Executes dropped EXE
    PID:5216

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1988

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:5448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3396

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding
1⤵
PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Aurora15Connector.06cd55fe63f147e79e35faa433061d85.new

Path C:\Users\Admin\AppData\Local\Aurora15Connector\Aurora15Connector.06cd55fe63f147e79e35faa433061d85.new
Size 14.0MB
SHA256 8feed168c8d7054a8cef1bd33076ff2608f6cafe33991171f6abace1b024c2a4
MD5 d69f9bc97f9cf4c4fd419a67307223cd
SHA1 cd7c51913a24a4e2b28f4be29f85dac352c44264
SHA512 33ab778aa38d612286890ca76ea9651de1cff5fbf6eb4fef232dda303a91a423ad6833c250d6fcccbdd136b7f7dd9852661ca7f85a6a93cb96a196d7a1b7b184
SSDEEP 196608:mWrWGSbtlhsvYGUx8/IBwbeYuBNx8/IBwbeYuBJHZjleN:mWrWLZlhsv+oIUuHoIUuPZjleN
TLSH
T170E6BE1493E500A1E47BD634CA22C733DAB57CA25A38C10F1559F6C61F73E928B6FB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Aurora15Connector.ini

Path C:\Users\Admin\AppData\Local\Aurora15Connector\Aurora15Connector.ini
Size 322B
SHA256 3d49fe92bfb99eec8ab483963e33e61b5b4bb38f2359907e727420a8fdf5c25e
MD5 884ecac13e273d37a4e6ad84a51a9923
SHA1 612e787d51f6dfe6d49d92444f3a23a8bc9473c7
SHA512 346081932168045ae93a1c760e1539e67741e451a53e178313444e77720c3580c96fcb6365ed374f3e8881b4f4cf6d5c8520a413b49fae5ad7ef94a4c97912e3
TLSH
T1ECE07D2333B651EF85F2A0AE901BEAB383B735290EC9E85310C41268315C410CB85091
MD5 SHA1 SHA512 TLSH

Submit Download

Aurora15Connector.exe

Path C:\Users\Admin\AppData\Local\Aurora15Connector\bootstrap\1.1.79-63D0D7A9C054ACC66717A756EF82935B99453B3F9A5C96C52975A93AAD851B99\Aurora15Connector.exe
Size 10.4MB
SHA256 63d0d7a9c054acc66717a756ef82935b99453b3f9a5c96c52975a93aad851b99
MD5 fbabec311e67bbfbe4a523d114ee06dc
SHA1 c80a6968536845d605dd6aa618ac463d9795faeb
SHA512 bfd40c88caee28aabcca70d63722bfbea7a97a0fcf585a25bf7b98d228801da83204575f4e8070003bb903260673cc70c510762eb64dac3c20d338648176aa14
SSDEEP 98304:JOwAg3AMp/UMAJQAv8D132jK6HbqlnN7G3yb1Si4Ju2SoCI+WaijK:JGg3AMZyCW8Dp2TH2lG+muRofK
TLSH
T1D0B69D14A3E501A5E57BDB34CA22C733CAB5BC925A34D10F0658F2C61F73A528B6F726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

launcher.log

Path C:\Users\Admin\AppData\Local\Aurora15Connector\logs\launcher.log
Size 649B
SHA256 c607995bcb7fb1a7abb5db1537ea57da28c9a2cc3542cf764e40a928a56f1484
MD5 1e1d5397e835b392a35c9c6a2a1d9de8
SHA1 f5f82fa39407027c7124bc7f5bca33a2e908bae1
SHA512 67743002287f1de98cdec8a32f8e1137b2da8763ba740cf0870ba37a3a8e73104258f04d23985e93ccc043ff9cd259e4a3213d7d6a6a3a523ddb9523d751f404
TLSH
T18FF0DB6D3B7208676A9B588551AF5FA41F10B59A93019E7217E621A0543C58A2F3B383
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.log

Path C:\Users\Admin\AppData\Local\Aurora15Connector\logs\launcher.log
Size 871B
SHA256 89287a164c69c8892eb66c37f838db494be06b7f12b20bed7001769b0d274dde
MD5 bb98259cfe3215372c7263d240a6edaf
SHA1 8a73731755cd6e56fe740f74845e65b643221c66
SHA512 b02096d6b6e24f4c1d0c08af3f908fa33ece01fb452cff637dce057870e01aed0ff8695a2e3affa4b7a0044e10f89222be065bc0d03f581d923e07065a344e62
TLSH
T131110A6C3F7608676A9B198551BB5FA40F10B197D3019E722BEA21B0543859A2F3B383
MD5 SHA1 SHA512 TLSH

Submit Download

launcher.log

Path C:\Users\Admin\AppData\Local\Aurora15Connector\logs\launcher.log
Size 1KB
SHA256 b0a969c5f7b7f671ceaef7412844e41a7cfb0bec7651b58c337e6005559f830c
MD5 fce405c91db625d23c26bcebe9396630
SHA1 29f2be300b5dc2c2fe44dafe999257a9b492daa8
SHA512 7bc4d4f714bd16561897126995105f11d99a1b62164e726b95ed2a5233656ca9ad3b3cb871838579ed8afb839cd8ca8a2bd7d07cc36713edd4cdfa19c3a9ccbf
TLSH
T103113E6C3F77086BAACB598581BB5F640F11B187D7019E712BD62270542C9DA2F37383
MD5 SHA1 SHA512 TLSH

Submit Download

launcher-afd39a40558a4d8f834d9922b2a4bde8.ready

Path C:\Users\Admin\AppData\Local\Aurora15Connector\updates\update-16d0dee0283f49f185aa2a1e8999ba4e\launcher-afd39a40558a4d8f834d9922b2a4bde8.ready
Size 64B
SHA256 de78e2823842c69291924594652e6dd73dcf8a4419c75428526b7641ca610c6d
MD5 e897134725ec01bc5084da4e8d3ea0c0
SHA1 5e49fc3e4b1e32e5909712ca53b5fd463c7063ec
SHA512 c646f067231083850e309b02505e31f4c483c44725ab38d1b31e54a905a9c2aeecfa5bb653e626e8afecfee95cf88f578ddcea96cf74c1372656f014d0176ec6
TLSH
T1BDA022A0C828000828080B0C08A0E028220000C0000E000C20AA808EE038E0802E0EE3
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads