821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d

Analysis

max time kernel
6s
max time network
10s
platform
windows7_x64
resource
win7v200722
submitted
18-10-2020 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d.exe
Size

128KB
MD5

a50da6451263aa74a68e4bda0b4e86fb
SHA1

b4f44d10e7e981c24b267b029f7061613767b2c0
SHA256

821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d
SHA512

87a563b351b320646c10e1081c83b9a9eba5046424cf3e6c3ffd8381550faa1004450633042541f52f38e3e7a58c0a0e08ac1551247940e29507378ae46e886a

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,C:\\Windows\\system32\\sdra64.exe,"	821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d.exe

Drops file in System32 directory 2 IoCs

Processes:

821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\sdra64.exe	821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d.exe
File created	C:\Windows\SysWOW64\sdra64.exe	821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d.exe

pid	process
1468	821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d.exe
1468	821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d.exe

C:\Users\Admin\AppData\Local\Temp\821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d.exe
"C:\Users\Admin\AppData\Local\Temp\821bf9d9232b278bf09392b3dcee0466c034250eaacb820cee92dc54f758080d.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:1468

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads