803d5b755bfb29e7fd30fe679ec21ccb1eb1ea89b19bbe1a989b4cf10d2ebca7

Analysis

max time kernel
146s
max time network
114s
platform
windows10_x64
resource
win10v20201028
submitted
11/11/2020, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6c3e529d873cab916befa4fe2f36184a.exe
Size 436KB
Sample201111-8gksrcvgla
SHA256 803d5b755bfb29e7fd30fe679ec21ccb1eb1ea89b19bbe1a989b4cf10d2ebca7
MD5 6c3e529d873cab916befa4fe2f36184a
SHA1 746eff99037cd5f4d3dd43e165ce4de57d65cb00
SHA512 e3bd98870c68bbc63795c991eebaed7baa97233a2cce8f9f2c516ff5e3d204b5fc9913cbe7f31143c4b3d5a00a0c0d18de72ad0c58abc3f6992bc1ea94eeff9a
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 5 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Program Files (x86)\\windows.exe.exe,"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
2180	windows.exe.exe
2220	windows.exe.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2180 set thread context of 2220	2180	windows.exe.exe	87

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\windows.exe.exe	cmd.exe
File opened for modification	C:\Program Files (x86)\windows.exe.exe	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2180	windows.exe.exe
2180	windows.exe.exe
2220	windows.exe.exe
2220	windows.exe.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	6c3e529d873cab916befa4fe2f36184a.exe
Token: SeDebugPrivilege	2180	windows.exe.exe
Token: SeDebugPrivilege	2220	windows.exe.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 2664	3372	6c3e529d873cab916befa4fe2f36184a.exe	78
PID 3372 wrote to memory of 2664	3372	6c3e529d873cab916befa4fe2f36184a.exe	78
PID 3372 wrote to memory of 2664	3372	6c3e529d873cab916befa4fe2f36184a.exe	78
PID 3372 wrote to memory of 3428	3372	6c3e529d873cab916befa4fe2f36184a.exe	80
PID 3372 wrote to memory of 3428	3372	6c3e529d873cab916befa4fe2f36184a.exe	80
PID 3372 wrote to memory of 3428	3372	6c3e529d873cab916befa4fe2f36184a.exe	80
PID 3428 wrote to memory of 2180	3428	cmd.exe	82
PID 3428 wrote to memory of 2180	3428	cmd.exe	82
PID 3428 wrote to memory of 2180	3428	cmd.exe	82
PID 2180 wrote to memory of 1284	2180	windows.exe.exe	83
PID 2180 wrote to memory of 1284	2180	windows.exe.exe	83
PID 2180 wrote to memory of 1284	2180	windows.exe.exe	83
PID 1284 wrote to memory of 2744	1284	cmd.exe	85
PID 1284 wrote to memory of 2744	1284	cmd.exe	85
PID 1284 wrote to memory of 2744	1284	cmd.exe	85
PID 2180 wrote to memory of 3592	2180	windows.exe.exe	86
PID 2180 wrote to memory of 3592	2180	windows.exe.exe	86
PID 2180 wrote to memory of 3592	2180	windows.exe.exe	86
PID 2180 wrote to memory of 2220	2180	windows.exe.exe	87
PID 2180 wrote to memory of 2220	2180	windows.exe.exe	87
PID 2180 wrote to memory of 2220	2180	windows.exe.exe	87
PID 3592 wrote to memory of 3924	3592	cmd.exe	89
PID 3592 wrote to memory of 3924	3592	cmd.exe	89
PID 3592 wrote to memory of 3924	3592	cmd.exe	89
PID 2180 wrote to memory of 2220	2180	windows.exe.exe	87
PID 2180 wrote to memory of 2220	2180	windows.exe.exe	87
PID 2180 wrote to memory of 2220	2180	windows.exe.exe	87
PID 2180 wrote to memory of 2220	2180	windows.exe.exe	87
PID 2180 wrote to memory of 2220	2180	windows.exe.exe	87
PID 2180 wrote to memory of 3852	2180	windows.exe.exe	90
PID 2180 wrote to memory of 3852	2180	windows.exe.exe	90
PID 2180 wrote to memory of 3852	2180	windows.exe.exe	90
PID 3852 wrote to memory of 2992	3852	cmd.exe	92
PID 3852 wrote to memory of 2992	3852	cmd.exe	92
PID 3852 wrote to memory of 2992	3852	cmd.exe	92
PID 2180 wrote to memory of 200	2180	windows.exe.exe	93
PID 2180 wrote to memory of 200	2180	windows.exe.exe	93
PID 2180 wrote to memory of 200	2180	windows.exe.exe	93
PID 200 wrote to memory of 2348	200	cmd.exe	95
PID 200 wrote to memory of 2348	200	cmd.exe	95
PID 200 wrote to memory of 2348	200	cmd.exe	95
PID 2180 wrote to memory of 1616	2180	windows.exe.exe	96
PID 2180 wrote to memory of 1616	2180	windows.exe.exe	96
PID 2180 wrote to memory of 1616	2180	windows.exe.exe	96
PID 1616 wrote to memory of 3396	1616	cmd.exe	98
PID 1616 wrote to memory of 3396	1616	cmd.exe	98
PID 1616 wrote to memory of 3396	1616	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\6c3e529d873cab916befa4fe2f36184a.exe
"C:\Users\Admin\AppData\Local\Temp\6c3e529d873cab916befa4fe2f36184a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\6c3e529d873cab916befa4fe2f36184a.exe" "C:\Program Files (x86)\windows.exe.exe"
  2⤵
  - Drops file in Program Files directory
  PID:2664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Program Files (x86)\windows.exe.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Program Files (x86)\windows.exe.exe
    "C:\Program Files (x86)\windows.exe.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1284
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2744
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3592
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3924
  - - C:\Program Files (x86)\windows.exe.exe
      "C:\Program Files (x86)\windows.exe.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2220
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3852
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2992
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:200
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:2348
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1616
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Program Files (x86)\windows.exe.exe,"
        5⤵
        Modifies WinLogon for persistence
        
        PID:3396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2180-23-0x0000000008990000-0x000000000899A000-memory.dmp

Download

memory/2180-25-0x0000000008C40000-0x0000000008C41000-memory.dmp

Download

memory/2180-13-0x0000000073940000-0x000000007402E000-memory.dmp

Download

memory/2220-34-0x0000000073940000-0x000000007402E000-memory.dmp

Download

memory/2220-31-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2220-41-0x00000000059E0000-0x00000000059E1000-memory.dmp

Download

memory/2220-42-0x0000000005A70000-0x0000000005A71000-memory.dmp

Download

memory/3372-0-0x0000000073940000-0x000000007402E000-memory.dmp

Download

memory/3372-7-0x0000000007F00000-0x0000000007F01000-memory.dmp

Download

memory/3372-6-0x0000000008320000-0x0000000008321000-memory.dmp

Download

memory/3372-5-0x0000000003130000-0x000000000314F000-memory.dmp

Download

memory/3372-4-0x00000000030A0000-0x00000000030B7000-memory.dmp

Download

memory/3372-3-0x0000000003270000-0x0000000003271000-memory.dmp

Download

memory/3372-1-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download