932a45c6f1123b2afe3c71be0e90382ca7bb2220cf96aa7d71b994eaa7e487ed

Analysis

max time kernel
141s
max time network
114s
platform
windows10_x64
resource
win10v20201028
submitted
10/11/2020, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe
Size 450KB
Sample201110-jnc3mxqxdx
SHA256 932a45c6f1123b2afe3c71be0e90382ca7bb2220cf96aa7d71b994eaa7e487ed
MD5 5da3ca0291ed7a1ee5b538e787db6244
SHA1 e14642400d1c8697971b4e9acae58e883c914b9d
SHA512 57b3bc14f7c3fbbad33c93e56303de9d9dad38d0022501242abbedbc1c707a8d34fc5c6b2d32c09e531f4ddaf86bc5fc33135baa011a9c6501be265a59053941
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
3724	windows.exe.exe
3608	windows.exe.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3724 set thread context of 3608	3724	windows.exe.exe	87

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\windows.exe.exe	cmd.exe
File created	C:\Program Files (x86)\windows.exe.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3608	windows.exe.exe
3608	windows.exe.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4040	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe
Token: SeDebugPrivilege	3724	windows.exe.exe
Token: SeDebugPrivilege	3608	windows.exe.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2808	4040	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	78
PID 4040 wrote to memory of 2808	4040	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	78
PID 4040 wrote to memory of 2808	4040	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	78
PID 4040 wrote to memory of 732	4040	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	80
PID 4040 wrote to memory of 732	4040	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	80
PID 4040 wrote to memory of 732	4040	SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe	80
PID 732 wrote to memory of 3724	732	cmd.exe	82
PID 732 wrote to memory of 3724	732	cmd.exe	82
PID 732 wrote to memory of 3724	732	cmd.exe	82
PID 3724 wrote to memory of 2036	3724	windows.exe.exe	83
PID 3724 wrote to memory of 2036	3724	windows.exe.exe	83
PID 3724 wrote to memory of 2036	3724	windows.exe.exe	83
PID 2036 wrote to memory of 2824	2036	cmd.exe	85
PID 2036 wrote to memory of 2824	2036	cmd.exe	85
PID 2036 wrote to memory of 2824	2036	cmd.exe	85
PID 3724 wrote to memory of 3976	3724	windows.exe.exe	86
PID 3724 wrote to memory of 3976	3724	windows.exe.exe	86
PID 3724 wrote to memory of 3976	3724	windows.exe.exe	86
PID 3724 wrote to memory of 3608	3724	windows.exe.exe	87
PID 3724 wrote to memory of 3608	3724	windows.exe.exe	87
PID 3724 wrote to memory of 3608	3724	windows.exe.exe	87
PID 3724 wrote to memory of 3608	3724	windows.exe.exe	87
PID 3724 wrote to memory of 3608	3724	windows.exe.exe	87
PID 3724 wrote to memory of 3608	3724	windows.exe.exe	87
PID 3724 wrote to memory of 3608	3724	windows.exe.exe	87
PID 3724 wrote to memory of 3608	3724	windows.exe.exe	87
PID 3976 wrote to memory of 204	3976	cmd.exe	89
PID 3976 wrote to memory of 204	3976	cmd.exe	89
PID 3976 wrote to memory of 204	3976	cmd.exe	89
PID 3724 wrote to memory of 1492	3724	windows.exe.exe	90
PID 3724 wrote to memory of 1492	3724	windows.exe.exe	90
PID 3724 wrote to memory of 1492	3724	windows.exe.exe	90
PID 1492 wrote to memory of 1820	1492	cmd.exe	92
PID 1492 wrote to memory of 1820	1492	cmd.exe	92
PID 1492 wrote to memory of 1820	1492	cmd.exe	92
PID 3724 wrote to memory of 2004	3724	windows.exe.exe	93
PID 3724 wrote to memory of 2004	3724	windows.exe.exe	93
PID 3724 wrote to memory of 2004	3724	windows.exe.exe	93
PID 2004 wrote to memory of 2288	2004	cmd.exe	95
PID 2004 wrote to memory of 2288	2004	cmd.exe	95
PID 2004 wrote to memory of 2288	2004	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.gh.3265.exe" "C:\Program Files (x86)\windows.exe.exe"
  2⤵
  - Drops file in Program Files directory
  PID:2808
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Program Files (x86)\windows.exe.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:732
- - C:\Program Files (x86)\windows.exe.exe
    "C:\Program Files (x86)\windows.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3724
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2824
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3976
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:204
  - - C:\Program Files (x86)\windows.exe.exe
      "C:\Program Files (x86)\windows.exe.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3608
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:1820
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2004
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3608-32-0x00000000733D0000-0x0000000073ABE000-memory.dmp

Download

memory/3608-40-0x0000000005880000-0x0000000005881000-memory.dmp

Download

memory/3608-39-0x0000000004D00000-0x0000000004D01000-memory.dmp

Download

memory/3608-34-0x0000000000700000-0x000000000073C000-memory.dmp

Download

memory/3724-23-0x0000000008F90000-0x0000000008F9A000-memory.dmp

Download

memory/3724-25-0x0000000009110000-0x0000000009111000-memory.dmp

Download

memory/3724-13-0x00000000733D0000-0x0000000073ABE000-memory.dmp

Download

memory/4040-5-0x00000000073A0000-0x00000000073BF000-memory.dmp

Download

memory/4040-4-0x0000000004D60000-0x0000000004D77000-memory.dmp

Download

memory/4040-3-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/4040-6-0x0000000007B50000-0x0000000007B51000-memory.dmp

Download

memory/4040-1-0x00000000005A0000-0x00000000005A1000-memory.dmp

Download

memory/4040-7-0x0000000007750000-0x0000000007751000-memory.dmp

Download

memory/4040-0-0x00000000733D0000-0x0000000073ABE000-memory.dmp

Download