3fc8d5c41f950cbf8a4becb6390221bbbb8c28a52fbc68b55296ccf6aaec7a45

Analysis

max time kernel
127s
max time network
126s
platform
windows10_x64
resource
win10-en-20211208
submitted
05/01/2022, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0437a4a387f2f71a2d7d3e791f73eb3a.exe
Size 752KB
Sample220105-nevcxaaefn
SHA256 3fc8d5c41f950cbf8a4becb6390221bbbb8c28a52fbc68b55296ccf6aaec7a45
MD5 0437a4a387f2f71a2d7d3e791f73eb3a
SHA1 276e322d162453c67a9f58747b6635746026de65
SHA512 55522f152af619688d62b7d7a619e7d862422664bd970d04d32f1fa94d1eba8db4db716c7fa49c3135dc1930726d3b4fdc1445cc5b542fd52375f1b3e32c0cc8
MD5 SHA1 SHA512

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Discord\\Discord.exe\","	0437a4a387f2f71a2d7d3e791f73eb3a.exe

Nirsoft 5 IoCs

resource	yara_rule
behavioral2/files/0x000500000001ab11-139.dat	Nirsoft
behavioral2/files/0x000500000001ab11-140.dat	Nirsoft
behavioral2/files/0x000500000001ab11-142.dat	Nirsoft
behavioral2/files/0x000500000001ab11-144.dat	Nirsoft
behavioral2/files/0x000500000001ab11-146.dat	Nirsoft

Executes dropped EXE 4 IoCs

pid	Process
1276	AdvancedRun.exe
2608	AdvancedRun.exe
1232	AdvancedRun.exe
2372	AdvancedRun.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2192 set thread context of 2340	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2676	powershell.exe
2676	powershell.exe
2676	powershell.exe
1276	AdvancedRun.exe
1276	AdvancedRun.exe
1276	AdvancedRun.exe
1276	AdvancedRun.exe
2608	AdvancedRun.exe
2608	AdvancedRun.exe
2608	AdvancedRun.exe
2608	AdvancedRun.exe
1232	AdvancedRun.exe
1232	AdvancedRun.exe
1232	AdvancedRun.exe
1232	AdvancedRun.exe
2372	AdvancedRun.exe
2372	AdvancedRun.exe
2372	AdvancedRun.exe
2372	AdvancedRun.exe
2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe
2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	2676	powershell.exe
Token: SeDebugPrivilege	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe
Token: SeDebugPrivilege	1276	AdvancedRun.exe
Token: SeImpersonatePrivilege	1276	AdvancedRun.exe
Token: SeDebugPrivilege	2608	AdvancedRun.exe
Token: SeImpersonatePrivilege	2608	AdvancedRun.exe
Token: SeDebugPrivilege	1232	AdvancedRun.exe
Token: SeImpersonatePrivilege	1232	AdvancedRun.exe
Token: SeDebugPrivilege	2372	AdvancedRun.exe
Token: SeImpersonatePrivilege	2372	AdvancedRun.exe
Token: SeDebugPrivilege	2340	0437a4a387f2f71a2d7d3e791f73eb3a.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2676	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	68
PID 2192 wrote to memory of 2676	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	68
PID 2192 wrote to memory of 1276	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	71
PID 2192 wrote to memory of 1276	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	71
PID 2192 wrote to memory of 1276	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	71
PID 1276 wrote to memory of 2608	1276	AdvancedRun.exe	72
PID 1276 wrote to memory of 2608	1276	AdvancedRun.exe	72
PID 1276 wrote to memory of 2608	1276	AdvancedRun.exe	72
PID 2192 wrote to memory of 1232	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	74
PID 2192 wrote to memory of 1232	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	74
PID 2192 wrote to memory of 1232	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	74
PID 1232 wrote to memory of 2372	1232	AdvancedRun.exe	75
PID 1232 wrote to memory of 2372	1232	AdvancedRun.exe	75
PID 1232 wrote to memory of 2372	1232	AdvancedRun.exe	75
PID 2192 wrote to memory of 1560	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	77
PID 2192 wrote to memory of 1560	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	77
PID 2192 wrote to memory of 2504	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	78
PID 2192 wrote to memory of 2504	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	78
PID 2192 wrote to memory of 2340	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	79
PID 2192 wrote to memory of 2340	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	79
PID 2192 wrote to memory of 2340	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	79
PID 2192 wrote to memory of 2340	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	79
PID 2192 wrote to memory of 2340	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	79
PID 2192 wrote to memory of 2340	2192	0437a4a387f2f71a2d7d3e791f73eb3a.exe	79

C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
"C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsA
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 1276
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2608
- C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 1232
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2372
- C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
  C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
  2⤵
  PID:1560
- C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
  C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
  2⤵
  PID:2504
- C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
  C:\Users\Admin\AppData\Local\Temp\0437a4a387f2f71a2d7d3e791f73eb3a.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-135-0x000000001B5F0000-0x000000001B6AE000-memory.dmp

Download

memory/2192-116-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/2192-115-0x0000000000970000-0x0000000000A32000-memory.dmp

Download

memory/2192-137-0x000000001B740000-0x000000001B742000-memory.dmp

Download

memory/2340-150-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2340-159-0x000000001BD74000-0x000000001BD75000-memory.dmp

Download

memory/2340-158-0x000000001BD72000-0x000000001BD74000-memory.dmp

Download

memory/2340-157-0x000000001C8B0000-0x000000001C8FC000-memory.dmp

Download

memory/2340-156-0x000000001C860000-0x000000001C8B4000-memory.dmp

Download

memory/2340-155-0x00000000011B0000-0x00000000011BC000-memory.dmp

Download

memory/2340-154-0x000000001C810000-0x000000001C860000-memory.dmp

Download

memory/2340-153-0x000000001BD70000-0x000000001BD72000-memory.dmp

Download

memory/2340-152-0x000000001BD80000-0x000000001BE06000-memory.dmp

Download

memory/2340-151-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2340-147-0x0000000000400000-0x0000000000480000-memory.dmp

Download

memory/2676-121-0x0000020E458C0000-0x0000020E458C2000-memory.dmp

Download

memory/2676-123-0x0000020E458C0000-0x0000020E458C2000-memory.dmp

Download

memory/2676-133-0x0000020E47523000-0x0000020E47525000-memory.dmp

Download

memory/2676-119-0x0000020E458C0000-0x0000020E458C2000-memory.dmp

Download

memory/2676-118-0x0000020E458C0000-0x0000020E458C2000-memory.dmp

Download

memory/2676-122-0x0000020E47530000-0x0000020E47552000-memory.dmp

Download

memory/2676-120-0x0000020E458C0000-0x0000020E458C2000-memory.dmp

Download

memory/2676-124-0x0000020E458C0000-0x0000020E458C2000-memory.dmp

Download

memory/2676-125-0x0000020E5F890000-0x0000020E5F906000-memory.dmp

Download

memory/2676-126-0x0000020E458C0000-0x0000020E458C2000-memory.dmp

Download

memory/2676-136-0x0000020E47526000-0x0000020E47528000-memory.dmp

Download

memory/2676-132-0x0000020E47520000-0x0000020E47522000-memory.dmp

Download

memory/2676-134-0x0000020E458C0000-0x0000020E458C2000-memory.dmp

Download