932a45c6f1123b2afe3c71be0e90382ca7bb2220cf96aa7d71b994eaa7e487ed

Analysis

max time kernel
135s
max time network
11s
platform
windows7_x64
resource
win7v20201028
submitted
10/11/2020, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe
Size 450KB
Sample201110-jnc3mxqxdx
SHA256 932a45c6f1123b2afe3c71be0e90382ca7bb2220cf96aa7d71b994eaa7e487ed
MD5 5da3ca0291ed7a1ee5b538e787db6244
SHA1 e14642400d1c8697971b4e9acae58e883c914b9d
SHA512 57b3bc14f7c3fbbad33c93e56303de9d9dad38d0022501242abbedbc1c707a8d34fc5c6b2d32c09e531f4ddaf86bc5fc33135baa011a9c6501be265a59053941
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
1216	windows.exe.exe
1912	windows.exe.exe

Loads dropped DLL 1 IoCs

pid	Process
1532	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1216 set thread context of 1912	1216	windows.exe.exe	39

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\windows.exe.exe	cmd.exe
File opened for modification	C:\Program Files (x86)\windows.exe.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1912	windows.exe.exe
1912	windows.exe.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe
Token: SeDebugPrivilege	1216	windows.exe.exe
Token: SeDebugPrivilege	1912	windows.exe.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 888	1588	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	29
PID 1588 wrote to memory of 888	1588	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	29
PID 1588 wrote to memory of 888	1588	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	29
PID 1588 wrote to memory of 888	1588	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	29
PID 1588 wrote to memory of 1532	1588	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	31
PID 1588 wrote to memory of 1532	1588	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	31
PID 1588 wrote to memory of 1532	1588	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	31
PID 1588 wrote to memory of 1532	1588	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	31
PID 1532 wrote to memory of 1216	1532	cmd.exe	33
PID 1532 wrote to memory of 1216	1532	cmd.exe	33
PID 1532 wrote to memory of 1216	1532	cmd.exe	33
PID 1532 wrote to memory of 1216	1532	cmd.exe	33
PID 1216 wrote to memory of 1812	1216	windows.exe.exe	34
PID 1216 wrote to memory of 1812	1216	windows.exe.exe	34
PID 1216 wrote to memory of 1812	1216	windows.exe.exe	34
PID 1216 wrote to memory of 1812	1216	windows.exe.exe	34
PID 1812 wrote to memory of 552	1812	cmd.exe	36
PID 1812 wrote to memory of 552	1812	cmd.exe	36
PID 1812 wrote to memory of 552	1812	cmd.exe	36
PID 1812 wrote to memory of 552	1812	cmd.exe	36
PID 1216 wrote to memory of 1516	1216	windows.exe.exe	37
PID 1216 wrote to memory of 1516	1216	windows.exe.exe	37
PID 1216 wrote to memory of 1516	1216	windows.exe.exe	37
PID 1216 wrote to memory of 1516	1216	windows.exe.exe	37
PID 1216 wrote to memory of 1912	1216	windows.exe.exe	39
PID 1216 wrote to memory of 1912	1216	windows.exe.exe	39
PID 1216 wrote to memory of 1912	1216	windows.exe.exe	39
PID 1216 wrote to memory of 1912	1216	windows.exe.exe	39
PID 1516 wrote to memory of 1684	1516	cmd.exe	40
PID 1516 wrote to memory of 1684	1516	cmd.exe	40
PID 1516 wrote to memory of 1684	1516	cmd.exe	40
PID 1516 wrote to memory of 1684	1516	cmd.exe	40
PID 1216 wrote to memory of 1912	1216	windows.exe.exe	39
PID 1216 wrote to memory of 1912	1216	windows.exe.exe	39
PID 1216 wrote to memory of 1912	1216	windows.exe.exe	39
PID 1216 wrote to memory of 1912	1216	windows.exe.exe	39
PID 1216 wrote to memory of 1912	1216	windows.exe.exe	39
PID 1216 wrote to memory of 1500	1216	windows.exe.exe	41
PID 1216 wrote to memory of 1500	1216	windows.exe.exe	41
PID 1216 wrote to memory of 1500	1216	windows.exe.exe	41
PID 1216 wrote to memory of 1500	1216	windows.exe.exe	41
PID 1500 wrote to memory of 1604	1500	cmd.exe	43
PID 1500 wrote to memory of 1604	1500	cmd.exe	43
PID 1500 wrote to memory of 1604	1500	cmd.exe	43
PID 1500 wrote to memory of 1604	1500	cmd.exe	43
PID 1216 wrote to memory of 1100	1216	windows.exe.exe	44
PID 1216 wrote to memory of 1100	1216	windows.exe.exe	44
PID 1216 wrote to memory of 1100	1216	windows.exe.exe	44
PID 1216 wrote to memory of 1100	1216	windows.exe.exe	44
PID 1100 wrote to memory of 1824	1100	cmd.exe	46
PID 1100 wrote to memory of 1824	1100	cmd.exe	46
PID 1100 wrote to memory of 1824	1100	cmd.exe	46
PID 1100 wrote to memory of 1824	1100	cmd.exe	46

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe" "C:\Program Files (x86)\windows.exe.exe"
  2⤵
  - Drops file in Program Files directory
  PID:888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Program Files (x86)\windows.exe.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Program Files (x86)\windows.exe.exe
    "C:\Program Files (x86)\windows.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1812
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:552
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1516
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1684
  - - C:\Program Files (x86)\windows.exe.exe
      "C:\Program Files (x86)\windows.exe.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1912
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1604
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1100
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1824

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-11-0x0000000073950000-0x000000007403E000-memory.dmp

Download

memory/1216-12-0x00000000012B0000-0x00000000012B1000-memory.dmp

Download

memory/1216-18-0x0000000000C50000-0x0000000000C5A000-memory.dmp

Download

memory/1588-4-0x0000000000820000-0x000000000083F000-memory.dmp

Download

memory/1588-0-0x0000000074670000-0x0000000074D5E000-memory.dmp

Download

memory/1588-3-0x0000000000480000-0x0000000000497000-memory.dmp

Download

memory/1588-1-0x00000000012E0000-0x00000000012E1000-memory.dmp

Download

memory/1912-23-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1912-27-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1912-26-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/1912-28-0x0000000073950000-0x000000007403E000-memory.dmp

Download