f7b1d5bbd052fe3fc584d4761eca593df99886add47527f965b5f27ee3cf02ba

Analysis

max time kernel
143s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 13:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7b1d5bbd052fe3fc584d4761eca593df99886add47527f965b5f27ee3cf02ba.exe
Size

112KB
MD5

6ea0ba5bf7c3a31e153af086342a37c0
SHA1

28ed4b1f65c6996c2dbd1cefae0df2f0f7ed916a
SHA256

f7b1d5bbd052fe3fc584d4761eca593df99886add47527f965b5f27ee3cf02ba
SHA512

9677aea372787bbc10ed1805171fbf5234b914426bed60ad7e1a616fc3d1c0fb1742f073bd86242d068dfd80b39ab71d7dabadc41ed75a9ab3bf55a6102c4f92
SSDEEP

1536:PP2DI4+Q/rLab4cvgZkjxX9go85v/o4VauIGuh/RrP0+FAt8cUiIFDk+:32DhC8cxxtD85Xo4Va/ZRj0+Fagi8D

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\skype.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1928	f7b1d5bbd052fe3fc584d4761eca593df99886add47527f965b5f27ee3cf02ba.exe
1136	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1928	f7b1d5bbd052fe3fc584d4761eca593df99886add47527f965b5f27ee3cf02ba.exe
1928	f7b1d5bbd052fe3fc584d4761eca593df99886add47527f965b5f27ee3cf02ba.exe

C:\Users\Admin\AppData\Local\Temp\f7b1d5bbd052fe3fc584d4761eca593df99886add47527f965b5f27ee3cf02ba.exe
"C:\Users\Admin\AppData\Local\Temp\f7b1d5bbd052fe3fc584d4761eca593df99886add47527f965b5f27ee3cf02ba.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1928

C:\Windows\syswow64\svchost.exe
"C:\Windows\syswow64\svchost.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1136-60-0x00000000762B1000-0x00000000762B3000-memory.dmp

Filesize
8KB

Download
memory/1400-58-0x00000000778E0000-0x0000000077A89000-memory.dmp

Filesize
1.7MB

Download
memory/1400-59-0x0000000002210000-0x0000000002217000-memory.dmp

Filesize
28KB

Download
memory/1928-54-0x00000000003B0000-0x00000000003B4000-memory.dmp

Filesize
16KB

Download
memory/1928-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1928-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1928-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download