1dc0ac4a972e50d3a75f9c99295d9d3012573f2c4ab00e77439f3bf4ddcd106e

General

Target
colfm5.exe
Size 337KB
Sample261018-x8y3macd36
SHA256 1dc0ac4a972e50d3a75f9c99295d9d3012573f2c4ab00e77439f3bf4ddcd106e
MD5 ef0d844c59781e3f734e4b96382d5415
SHA1 6e29aadd07508a1b38ec10546d9899bc8ff6097e
SHA512 5ee69e12e8d5896ff0e297eafcc1bc2c4618aced29eafa782a41553cf6d504c8cfb702986cb2101dd1891aebbcaa4d12af9ddeb31dd1b744806954b512b19f42
SSDEEP 6144:rFrO/dV1C9mg3HhVCDIz5R50Mj7YwikaxbORr9VSnl+:Rr+1C9vp7Ni3kRyl+
TLSH
T1EF7492393FE44D26F69146BDC0FA6656C32666963223B387B34375720E8634EEE193C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4644	RuntimeBroker.exe
3224	Xdefender.exe
3068	RuntimeBroker.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\pwndefeder\RuntimeBroker.exe	colfm5.exe
File created	C:\Windows\pwnSpeechruntimecache\Xdefender.exe	colfm5.exe
File opened for modification	C:\Windows\pwnSpeechruntimecache\Xdefender.exe	colfm5.exe
File created	C:\Windows\pwndefeder\RuntimeBroker.exe	colfm5.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6120	cmd.exe
4668	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Xdefender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Xdefender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	colfm5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	colfm5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RuntimeBroker.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RuntimeBroker.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4432	schtasks.exe
624	schtasks.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1968	colfm5.exe
Token: SeDebugPrivilege	4644	RuntimeBroker.exe
Token: SeDebugPrivilege	3224	Xdefender.exe
Token: SeDebugPrivilege	3068	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 6120	1968	colfm5.exe	90
PID 1968 wrote to memory of 4668	1968	colfm5.exe	91
PID 6120 wrote to memory of 4432	6120	cmd.exe	94
PID 4668 wrote to memory of 624	4668	cmd.exe	95
PID 1968 wrote to memory of 3068	1968	colfm5.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\colfm5.exe
"C:\Users\Admin\AppData\Local\Temp\colfm5.exe"
1⤵
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 5 /tn "SystemCache\FileZilla" /tr "C:\Windows\pwndefeder\RuntimeBroker.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 5 /tn "SystemCache\FileZilla" /tr "C:\Windows\pwndefeder\RuntimeBroker.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4432
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "MicrosoftDebug\OracleChrome" /tr "C:\Windows\pwnSpeechruntimecache\Xdefender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "MicrosoftDebug\OracleChrome" /tr "C:\Windows\pwnSpeechruntimecache\Xdefender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:624
- C:\Windows\pwndefeder\RuntimeBroker.exe
  "C:\Windows\pwndefeder\RuntimeBroker.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:3068

C:\Windows\pwndefeder\RuntimeBroker.exe
C:\Windows\pwndefeder\RuntimeBroker.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\pwnSpeechruntimecache\Xdefender.exe
C:\Windows\pwnSpeechruntimecache\Xdefender.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3224