d827689b395e61faaa11fcf68118f58ae90a291819e1dabe2fd1f91c37805ee2

General

Target
7e67efbba22afde4bcabfb39000f726f.exe
Size 48KB
Sample201208-lvbktzymhs
SHA256 d827689b395e61faaa11fcf68118f58ae90a291819e1dabe2fd1f91c37805ee2
MD5 7e67efbba22afde4bcabfb39000f726f
SHA1 099610126fb34413ff69e2d624b922a2603ad3d4
SHA512 cc41379c36b24a81bd5216a46e6cd11827dc5f4a220905797b54b998a9f1f40547d586ff04668e5e409f0f61a8b7fb6101f1986a4794a9e8d0ea2874843afe74
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\7e67efbba22afde4bcabfb39000f726f.exe\""	7e67efbba22afde4bcabfb39000f726f.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7e67efbba22afde4bcabfb39000f726f.exe	7e67efbba22afde4bcabfb39000f726f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7e67efbba22afde4bcabfb39000f726f.exe	7e67efbba22afde4bcabfb39000f726f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7e67efbba22afde4bcabfb39000f726f.exe"	7e67efbba22afde4bcabfb39000f726f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\7e67efbba22afde4bcabfb39000f726f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7e67efbba22afde4bcabfb39000f726f.exe"	7e67efbba22afde4bcabfb39000f726f.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1756	7e67efbba22afde4bcabfb39000f726f.exe
1756	7e67efbba22afde4bcabfb39000f726f.exe
1756	7e67efbba22afde4bcabfb39000f726f.exe
1756	7e67efbba22afde4bcabfb39000f726f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1580 set thread context of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1936	timeout.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1580	7e67efbba22afde4bcabfb39000f726f.exe
Token: SeDebugPrivilege	1756	7e67efbba22afde4bcabfb39000f726f.exe
Token: SeShutdownPrivilege	1756	7e67efbba22afde4bcabfb39000f726f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1756	7e67efbba22afde4bcabfb39000f726f.exe
1756	7e67efbba22afde4bcabfb39000f726f.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1420	1580	7e67efbba22afde4bcabfb39000f726f.exe	26
PID 1580 wrote to memory of 1420	1580	7e67efbba22afde4bcabfb39000f726f.exe	26
PID 1580 wrote to memory of 1420	1580	7e67efbba22afde4bcabfb39000f726f.exe	26
PID 1580 wrote to memory of 1420	1580	7e67efbba22afde4bcabfb39000f726f.exe	26
PID 1420 wrote to memory of 1936	1420	cmd.exe	28
PID 1420 wrote to memory of 1936	1420	cmd.exe	28
PID 1420 wrote to memory of 1936	1420	cmd.exe	28
PID 1420 wrote to memory of 1936	1420	cmd.exe	28
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32
PID 1580 wrote to memory of 1756	1580	7e67efbba22afde4bcabfb39000f726f.exe	32

C:\Users\Admin\AppData\Local\Temp\7e67efbba22afde4bcabfb39000f726f.exe
"C:\Users\Admin\AppData\Local\Temp\7e67efbba22afde4bcabfb39000f726f.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 4.511
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4.511
    3⤵
    - Delays execution with timeout.exe
    PID:1936
- C:\Users\Admin\AppData\Local\Temp\7e67efbba22afde4bcabfb39000f726f.exe
  "C:\Users\Admin\AppData\Local\Temp\7e67efbba22afde4bcabfb39000f726f.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-7-0x0000000007F70000-0x00000000082B8000-memory.dmp

Download

memory/1580-3-0x0000000001160000-0x0000000001161000-memory.dmp

Download

memory/1580-2-0x00000000744C0000-0x0000000074BAE000-memory.dmp

Download

memory/1756-12-0x0000000000120000-0x0000000000121000-memory.dmp

Download

memory/1756-8-0x0000000000400000-0x0000000000737000-memory.dmp

Download

memory/1756-10-0x0000000000400000-0x0000000000737000-memory.dmp

Download

memory/1756-11-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/1756-13-0x0000000000110000-0x0000000000111000-memory.dmp

Download

memory/1756-14-0x0000000000120000-0x0000000000121000-memory.dmp

Download

memory/1756-16-0x0000000000120000-0x0000000000121000-memory.dmp

Download

memory/1756-18-0x0000000000120000-0x0000000000121000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads