Analysis

  • max time kernel
    126s
  • max time network
    13s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    13-01-2021 20:11

General

  • Target

    Scan34295420.scr

  • Size

    875KB

  • MD5

    389ca41e54649946a7b8b1c15d0da2df

  • SHA1

    3ce9137efc80c5e169cb9b0a200339fae09c1202

  • SHA256

    75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

  • SHA512

    6fc158d738aa3112ad81b84e8c2b68f73828c40dec9654abd8d6ee2147b50f47b7e7df87cb277b5bd9cd4e95f73905438f12346407aac0ca545c6a0591210c95

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Scan34295420.scr
    "C:\Users\Admin\AppData\Local\Temp\Scan34295420.scr" /S
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1852
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\windows.exe,"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1384
      • C:\Windows\SysWOW64\reg.exe
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\windows.exe,"
        3⤵
        • Modifies WinLogon for persistence
        PID:1984
    • C:\Users\Admin\AppData\Local\Temp\windows.exe
      "C:\Users\Admin\AppData\Local\Temp\windows.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1380
      • C:\Users\Admin\AppData\Roaming\windows.exe
        "C:\Users\Admin\AppData\Roaming\windows.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:784
        • C:\Users\Admin\AppData\Local\Temp\windows.exe
          "C:\Users\Admin\AppData\Local\Temp\windows.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:768
          • C:\Users\Admin\AppData\Roaming\windows.exe
            "C:\Users\Admin\AppData\Roaming\windows.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1952
            • C:\Users\Admin\AppData\Local\Temp\windows.exe
              "C:\Users\Admin\AppData\Local\Temp\windows.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2028
              • C:\Users\Admin\AppData\Roaming\windows.exe
                "C:\Users\Admin\AppData\Roaming\windows.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:644
                • C:\Users\Admin\AppData\Local\Temp\windows.exe
                  "C:\Users\Admin\AppData\Local\Temp\windows.exe"
                  8⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1492

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\windows.exe
    MD5

    389ca41e54649946a7b8b1c15d0da2df

    SHA1

    3ce9137efc80c5e169cb9b0a200339fae09c1202

    SHA256

    75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

    SHA512

    6fc158d738aa3112ad81b84e8c2b68f73828c40dec9654abd8d6ee2147b50f47b7e7df87cb277b5bd9cd4e95f73905438f12346407aac0ca545c6a0591210c95

  • C:\Users\Admin\AppData\Local\Temp\windows.exe
    MD5

    389ca41e54649946a7b8b1c15d0da2df

    SHA1

    3ce9137efc80c5e169cb9b0a200339fae09c1202

    SHA256

    75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

    SHA512

    6fc158d738aa3112ad81b84e8c2b68f73828c40dec9654abd8d6ee2147b50f47b7e7df87cb277b5bd9cd4e95f73905438f12346407aac0ca545c6a0591210c95

  • C:\Users\Admin\AppData\Local\Temp\windows.exe
    MD5

    389ca41e54649946a7b8b1c15d0da2df

    SHA1

    3ce9137efc80c5e169cb9b0a200339fae09c1202

    SHA256

    75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

    SHA512

    6fc158d738aa3112ad81b84e8c2b68f73828c40dec9654abd8d6ee2147b50f47b7e7df87cb277b5bd9cd4e95f73905438f12346407aac0ca545c6a0591210c95

  • C:\Users\Admin\AppData\Roaming\windows.exe
    MD5

    389ca41e54649946a7b8b1c15d0da2df

    SHA1

    3ce9137efc80c5e169cb9b0a200339fae09c1202

    SHA256

    75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

    SHA512

    6fc158d738aa3112ad81b84e8c2b68f73828c40dec9654abd8d6ee2147b50f47b7e7df87cb277b5bd9cd4e95f73905438f12346407aac0ca545c6a0591210c95

  • C:\Users\Admin\AppData\Roaming\windows.exe
    MD5

    389ca41e54649946a7b8b1c15d0da2df

    SHA1

    3ce9137efc80c5e169cb9b0a200339fae09c1202

    SHA256

    75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

    SHA512

    6fc158d738aa3112ad81b84e8c2b68f73828c40dec9654abd8d6ee2147b50f47b7e7df87cb277b5bd9cd4e95f73905438f12346407aac0ca545c6a0591210c95

  • C:\Users\Admin\AppData\Roaming\windows.exe
    MD5

    389ca41e54649946a7b8b1c15d0da2df

    SHA1

    3ce9137efc80c5e169cb9b0a200339fae09c1202

    SHA256

    75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

    SHA512

    6fc158d738aa3112ad81b84e8c2b68f73828c40dec9654abd8d6ee2147b50f47b7e7df87cb277b5bd9cd4e95f73905438f12346407aac0ca545c6a0591210c95

  • C:\Users\Admin\AppData\Roaming\windows.exe
    MD5

    389ca41e54649946a7b8b1c15d0da2df

    SHA1

    3ce9137efc80c5e169cb9b0a200339fae09c1202

    SHA256

    75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

    SHA512

    6fc158d738aa3112ad81b84e8c2b68f73828c40dec9654abd8d6ee2147b50f47b7e7df87cb277b5bd9cd4e95f73905438f12346407aac0ca545c6a0591210c95

  • C:\Users\Admin\AppData\Roaming\windows.exe
    MD5

    389ca41e54649946a7b8b1c15d0da2df

    SHA1

    3ce9137efc80c5e169cb9b0a200339fae09c1202

    SHA256

    75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

    SHA512

    6fc158d738aa3112ad81b84e8c2b68f73828c40dec9654abd8d6ee2147b50f47b7e7df87cb277b5bd9cd4e95f73905438f12346407aac0ca545c6a0591210c95

  • C:\Users\Admin\AppData\Roaming\windows.exe
    MD5

    389ca41e54649946a7b8b1c15d0da2df

    SHA1

    3ce9137efc80c5e169cb9b0a200339fae09c1202

    SHA256

    75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

    SHA512

    6fc158d738aa3112ad81b84e8c2b68f73828c40dec9654abd8d6ee2147b50f47b7e7df87cb277b5bd9cd4e95f73905438f12346407aac0ca545c6a0591210c95

  • \Users\Admin\AppData\Roaming\windows.exe
    MD5

    389ca41e54649946a7b8b1c15d0da2df

    SHA1

    3ce9137efc80c5e169cb9b0a200339fae09c1202

    SHA256

    75674ba2558d6fcf6d3992f09bd87aab282ea0b2d9bd01d6e0149a869506e3ce

    SHA512

    6fc158d738aa3112ad81b84e8c2b68f73828c40dec9654abd8d6ee2147b50f47b7e7df87cb277b5bd9cd4e95f73905438f12346407aac0ca545c6a0591210c95

  • memory/644-46-0x0000000000000000-mapping.dmp
  • memory/644-49-0x0000000074840000-0x0000000074F2E000-memory.dmp
    Filesize

    6.9MB

  • memory/644-50-0x0000000000270000-0x0000000000271000-memory.dmp
    Filesize

    4KB

  • memory/768-26-0x0000000074840000-0x0000000074F2E000-memory.dmp
    Filesize

    6.9MB

  • memory/768-24-0x0000000000000000-mapping.dmp
  • memory/784-20-0x0000000000BD0000-0x0000000000BD1000-memory.dmp
    Filesize

    4KB

  • memory/784-19-0x0000000074840000-0x0000000074F2E000-memory.dmp
    Filesize

    6.9MB

  • memory/784-16-0x0000000000000000-mapping.dmp
  • memory/1380-10-0x0000000074840000-0x0000000074F2E000-memory.dmp
    Filesize

    6.9MB

  • memory/1380-9-0x0000000000000000-mapping.dmp
  • memory/1384-7-0x0000000000000000-mapping.dmp
  • memory/1492-56-0x0000000074840000-0x0000000074F2E000-memory.dmp
    Filesize

    6.9MB

  • memory/1492-54-0x0000000000000000-mapping.dmp
  • memory/1852-2-0x0000000074840000-0x0000000074F2E000-memory.dmp
    Filesize

    6.9MB

  • memory/1852-3-0x0000000000330000-0x0000000000331000-memory.dmp
    Filesize

    4KB

  • memory/1852-6-0x0000000000310000-0x0000000000311000-memory.dmp
    Filesize

    4KB

  • memory/1852-5-0x00000000002F0000-0x000000000030E000-memory.dmp
    Filesize

    120KB

  • memory/1952-31-0x0000000000000000-mapping.dmp
  • memory/1952-34-0x0000000074840000-0x0000000074F2E000-memory.dmp
    Filesize

    6.9MB

  • memory/1952-35-0x0000000000B50000-0x0000000000B51000-memory.dmp
    Filesize

    4KB

  • memory/1984-8-0x0000000000000000-mapping.dmp
  • memory/2028-41-0x0000000074840000-0x0000000074F2E000-memory.dmp
    Filesize

    6.9MB

  • memory/2028-39-0x0000000000000000-mapping.dmp