d827689b395e61faaa11fcf68118f58ae90a291819e1dabe2fd1f91c37805ee2

General

Target
7e67efbba22afde4bcabfb39000f726f.exe
Size 48KB
Sample201208-lvbktzymhs
SHA256 d827689b395e61faaa11fcf68118f58ae90a291819e1dabe2fd1f91c37805ee2
MD5 7e67efbba22afde4bcabfb39000f726f
SHA1 099610126fb34413ff69e2d624b922a2603ad3d4
SHA512 cc41379c36b24a81bd5216a46e6cd11827dc5f4a220905797b54b998a9f1f40547d586ff04668e5e409f0f61a8b7fb6101f1986a4794a9e8d0ea2874843afe74
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\7e67efbba22afde4bcabfb39000f726f.exe\""	7e67efbba22afde4bcabfb39000f726f.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7e67efbba22afde4bcabfb39000f726f.exe	7e67efbba22afde4bcabfb39000f726f.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7e67efbba22afde4bcabfb39000f726f.exe	7e67efbba22afde4bcabfb39000f726f.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7e67efbba22afde4bcabfb39000f726f.exe"	7e67efbba22afde4bcabfb39000f726f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\7e67efbba22afde4bcabfb39000f726f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7e67efbba22afde4bcabfb39000f726f.exe"	7e67efbba22afde4bcabfb39000f726f.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2124	7e67efbba22afde4bcabfb39000f726f.exe
2124	7e67efbba22afde4bcabfb39000f726f.exe
2124	7e67efbba22afde4bcabfb39000f726f.exe
2124	7e67efbba22afde4bcabfb39000f726f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 972 set thread context of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2308	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
972	7e67efbba22afde4bcabfb39000f726f.exe
972	7e67efbba22afde4bcabfb39000f726f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	972	7e67efbba22afde4bcabfb39000f726f.exe
Token: SeShutdownPrivilege	2124	7e67efbba22afde4bcabfb39000f726f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2124	7e67efbba22afde4bcabfb39000f726f.exe
2124	7e67efbba22afde4bcabfb39000f726f.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 1192	972	7e67efbba22afde4bcabfb39000f726f.exe	76
PID 972 wrote to memory of 1192	972	7e67efbba22afde4bcabfb39000f726f.exe	76
PID 972 wrote to memory of 1192	972	7e67efbba22afde4bcabfb39000f726f.exe	76
PID 1192 wrote to memory of 2308	1192	cmd.exe	78
PID 1192 wrote to memory of 2308	1192	cmd.exe	78
PID 1192 wrote to memory of 2308	1192	cmd.exe	78
PID 972 wrote to memory of 2192	972	7e67efbba22afde4bcabfb39000f726f.exe	82
PID 972 wrote to memory of 2192	972	7e67efbba22afde4bcabfb39000f726f.exe	82
PID 972 wrote to memory of 2192	972	7e67efbba22afde4bcabfb39000f726f.exe	82
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83
PID 972 wrote to memory of 2124	972	7e67efbba22afde4bcabfb39000f726f.exe	83

C:\Users\Admin\AppData\Local\Temp\7e67efbba22afde4bcabfb39000f726f.exe
"C:\Users\Admin\AppData\Local\Temp\7e67efbba22afde4bcabfb39000f726f.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 4.511
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\timeout.exe
    timeout 4.511
    3⤵
    - Delays execution with timeout.exe
    PID:2308
- C:\Users\Admin\AppData\Local\Temp\7e67efbba22afde4bcabfb39000f726f.exe
  "C:\Users\Admin\AppData\Local\Temp\7e67efbba22afde4bcabfb39000f726f.exe"
  2⤵
  PID:2192
- C:\Users\Admin\AppData\Local\Temp\7e67efbba22afde4bcabfb39000f726f.exe
  "C:\Users\Admin\AppData\Local\Temp\7e67efbba22afde4bcabfb39000f726f.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2124

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/972-11-0x0000000011FC0000-0x0000000012308000-memory.dmp

Download

memory/972-3-0x00000000007C0000-0x00000000007C1000-memory.dmp

Download

memory/972-5-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Download

memory/972-6-0x0000000005550000-0x0000000005551000-memory.dmp

Download

memory/972-7-0x0000000005180000-0x0000000005181000-memory.dmp

Download

memory/972-8-0x0000000005090000-0x0000000005091000-memory.dmp

Download

memory/972-2-0x0000000073A30000-0x000000007411E000-memory.dmp

Download

memory/2124-12-0x0000000000400000-0x0000000000737000-memory.dmp

Download

memory/2124-14-0x0000000000400000-0x0000000000737000-memory.dmp

Download

memory/2124-15-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads