3fc8d5c41f950cbf8a4becb6390221bbbb8c28a52fbc68b55296ccf6aaec7a45

Analysis

max time kernel
134s
max time network
136s
platform
windows7_x64
resource
win7-en-20211208
submitted
05/01/2022, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0437a4a387f2f71a2d7d3e791f73eb3a.exe
Size 752KB
Sample220105-nevcxaaefn
SHA256 3fc8d5c41f950cbf8a4becb6390221bbbb8c28a52fbc68b55296ccf6aaec7a45
MD5 0437a4a387f2f71a2d7d3e791f73eb3a
SHA1 276e322d162453c67a9f58747b6635746026de65
SHA512 55522f152af619688d62b7d7a619e7d862422664bd970d04d32f1fa94d1eba8db4db716c7fa49c3135dc1930726d3b4fdc1445cc5b542fd52375f1b3e32c0cc8
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Discord\\Discord.exe\","	0437a4a387f2f71a2d7d3e791f73eb3a.exe

Nirsoft 9 IoCs

resource	yara_rule
behavioral1/files/0x001300000000b4ce-68.dat	Nirsoft
behavioral1/files/0x001300000000b4ce-70.dat	Nirsoft
behavioral1/files/0x001300000000b4ce-71.dat	Nirsoft
behavioral1/files/0x001300000000b4ce-72.dat	Nirsoft
behavioral1/files/0x001300000000b4ce-74.dat	Nirsoft
behavioral1/files/0x001300000000b4ce-77.dat	Nirsoft
behavioral1/files/0x001300000000b4ce-79.dat	Nirsoft
behavioral1/files/0x001300000000b4ce-80.dat	Nirsoft
behavioral1/files/0x001300000000b4ce-82.dat	Nirsoft

Executes dropped EXE 4 IoCs

pid	Process
1204	AdvancedRun.exe
1820	AdvancedRun.exe
1524	AdvancedRun.exe
1544	AdvancedRun.exe

Loads dropped DLL 4 IoCs

pid	Process
1204	AdvancedRun.exe
1204	AdvancedRun.exe
1524	AdvancedRun.exe
1524	AdvancedRun.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 740 set thread context of 1276	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
320	powershell.exe
1204	AdvancedRun.exe
1204	AdvancedRun.exe
1820	AdvancedRun.exe
1820	AdvancedRun.exe
1524	AdvancedRun.exe
1524	AdvancedRun.exe
1544	AdvancedRun.exe
1544	AdvancedRun.exe
740	0437a4a387f2f71a2d7d3e791f73eb3a.exe
740	0437a4a387f2f71a2d7d3e791f73eb3a.exe
740	0437a4a387f2f71a2d7d3e791f73eb3a.exe
740	0437a4a387f2f71a2d7d3e791f73eb3a.exe
1276	0437a4a387f2f71a2d7d3e791f73eb3a.exe
1276	0437a4a387f2f71a2d7d3e791f73eb3a.exe
1276	0437a4a387f2f71a2d7d3e791f73eb3a.exe
1276	0437a4a387f2f71a2d7d3e791f73eb3a.exe
1276	0437a4a387f2f71a2d7d3e791f73eb3a.exe
1276	0437a4a387f2f71a2d7d3e791f73eb3a.exe
1276	0437a4a387f2f71a2d7d3e791f73eb3a.exe
1276	0437a4a387f2f71a2d7d3e791f73eb3a.exe
1276	0437a4a387f2f71a2d7d3e791f73eb3a.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	320	powershell.exe
Token: SeDebugPrivilege	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe
Token: SeDebugPrivilege	1204	AdvancedRun.exe
Token: SeImpersonatePrivilege	1204	AdvancedRun.exe
Token: SeDebugPrivilege	1820	AdvancedRun.exe
Token: SeImpersonatePrivilege	1820	AdvancedRun.exe
Token: SeDebugPrivilege	1524	AdvancedRun.exe
Token: SeImpersonatePrivilege	1524	AdvancedRun.exe
Token: SeDebugPrivilege	1544	AdvancedRun.exe
Token: SeImpersonatePrivilege	1544	AdvancedRun.exe
Token: SeDebugPrivilege	1276	0437a4a387f2f71a2d7d3e791f73eb3a.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 320	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	27
PID 740 wrote to memory of 320	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	27
PID 740 wrote to memory of 320	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	27
PID 740 wrote to memory of 1204	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	29
PID 740 wrote to memory of 1204	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	29
PID 740 wrote to memory of 1204	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	29
PID 740 wrote to memory of 1204	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	29
PID 1204 wrote to memory of 1820	1204	AdvancedRun.exe	30
PID 1204 wrote to memory of 1820	1204	AdvancedRun.exe	30
PID 1204 wrote to memory of 1820	1204	AdvancedRun.exe	30
PID 1204 wrote to memory of 1820	1204	AdvancedRun.exe	30
PID 740 wrote to memory of 1524	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	31
PID 740 wrote to memory of 1524	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	31
PID 740 wrote to memory of 1524	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	31
PID 740 wrote to memory of 1524	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	31
PID 1524 wrote to memory of 1544	1524	AdvancedRun.exe	32
PID 1524 wrote to memory of 1544	1524	AdvancedRun.exe	32
PID 1524 wrote to memory of 1544	1524	AdvancedRun.exe	32
PID 1524 wrote to memory of 1544	1524	AdvancedRun.exe	32
PID 740 wrote to memory of 668	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	34
PID 740 wrote to memory of 668	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	34
PID 740 wrote to memory of 668	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	34
PID 740 wrote to memory of 1276	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	35
PID 740 wrote to memory of 1276	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	35
PID 740 wrote to memory of 1276	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	35
PID 740 wrote to memory of 1276	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	35
PID 740 wrote to memory of 1276	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	35
PID 740 wrote to memory of 1276	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	35
PID 740 wrote to memory of 1276	740	0437a4a387f2f71a2d7d3e791f73eb3a.exe	35

C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
"C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:320
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 1204
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1820
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 1524
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1544
- C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
  C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
  2⤵
  PID:668
- C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
  C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-59-0x000007FEEE5F0000-0x000007FEEF14D000-memory.dmp

Download

memory/320-64-0x00000000027BB000-0x00000000027DA000-memory.dmp

Download

memory/320-63-0x000000001B810000-0x000000001BB0F000-memory.dmp

Download

memory/320-61-0x00000000027B2000-0x00000000027B4000-memory.dmp

Download

memory/320-62-0x00000000027B4000-0x00000000027B7000-memory.dmp

Download

memory/320-60-0x00000000027B0000-0x00000000027B2000-memory.dmp

Download

memory/740-65-0x000000001AE00000-0x000000001AEBE000-memory.dmp

Download

memory/740-56-0x000007FEFC0E1000-0x000007FEFC0E3000-memory.dmp

Download

memory/740-66-0x000000001B8F0000-0x000000001B8F2000-memory.dmp

Download

memory/740-55-0x0000000000110000-0x00000000001D2000-memory.dmp

Download

memory/740-54-0x0000000000110000-0x00000000001D2000-memory.dmp

Download

memory/1204-69-0x0000000076141000-0x0000000076143000-memory.dmp

Download

memory/1276-85-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1276-90-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1276-97-0x000000001A936000-0x000000001A955000-memory.dmp

Download

memory/1276-84-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1276-96-0x000000001A9B0000-0x000000001A9FC000-memory.dmp

Download

memory/1276-86-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1276-87-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1276-89-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/1276-95-0x0000000000940000-0x0000000000994000-memory.dmp

Download

memory/1276-91-0x000000001A8A0000-0x000000001A926000-memory.dmp

Download

memory/1276-92-0x000000001A930000-0x000000001A932000-memory.dmp

Download

memory/1276-93-0x00000000003A0000-0x00000000003F0000-memory.dmp

Download

memory/1276-94-0x0000000000240000-0x000000000024C000-memory.dmp

Download