77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc

Analysis

max time kernel
148s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/10/2022, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe
Size

435KB
MD5

387050f87fe3ff8dbedf3c097233a710
SHA1

3d060c5c5065e44652a59d405ff4754bc88ba426
SHA256

77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc
SHA512

645af124b2fcfed670c00ec9ab2a53964077936c32d1df5091310eca9075dc955465257f8b23358792c031e3348a453e7b6a4f3b31d175a4d9e4b98bc785cb56
SSDEEP

3072:TSWVa1rLfhE9vDH8/Wg1kuWZyxOvxQggjbdRYEX+RotB5:fVa1rLhAeKuWZyxOqXjGsL

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
912	sysmgr.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	sysmgr.exe
File opened (read-only)	\??\F:	sysmgr.exe
File opened (read-only)	\??\G:	sysmgr.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4"	sysmgr.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	sysmgr.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\conf.dat	sysmgr.exe
File created	C:\Windows\conf.dat	sysmgr.exe
File created	C:\Windows\sysmgr.exe	77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe
File created	C:\Windows\svc.dat	77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1812 wrote to memory of 912	1812	77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe	28
PID 1812 wrote to memory of 912	1812	77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe	28
PID 1812 wrote to memory of 912	1812	77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe	28
PID 1812 wrote to memory of 912	1812	77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe	28

C:\Users\Admin\AppData\Local\Temp\77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe
"C:\Users\Admin\AppData\Local\Temp\77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1812
- C:\Windows\sysmgr.exe
  "C:\Windows\sysmgr.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:912

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svc.dat

Filesize
2KB

MD5
aff9b1ba045815e945bbaac4501e194d

SHA1
1af9db351c56ae8aea693b946a3cb3b53e140a86

SHA256
91a45c3cd09365eb09866a799d5837378b6bc302f98efebc6195fde60155ab5f

SHA512
5d4abf9d16c2972a4a27b41a6b276e99b8ddf998cdfdf3f64dd766c7b76eaf334b69b29cd0a11dbc6875be59bccf26ac70124cb8524d10307a41734dd06f64d2

Download Submit
C:\Windows\sysmgr.exe

Filesize
36KB

MD5
2373dfbdba70b54164d4fe163f7f59f1

SHA1
fbc51778f9e4868ddce4763d0bef4cb48090e3f6

SHA256
e506e529d2d1d80ba433d4dec9fcbf07506112c8d0a130bed322f03346640456

SHA512
32e48c596def05ddd1c987ae54cb069f750e0e4a993aa9f5c1d69e11c49ca90f6d324dfb4fa7c29c7d642eb2d939b2efe9332e0f4f4cbc5a0b2893adbf8598ec

Download Submit
C:\Windows\sysmgr.exe

Filesize
36KB

MD5
2373dfbdba70b54164d4fe163f7f59f1

SHA1
fbc51778f9e4868ddce4763d0bef4cb48090e3f6

SHA256
e506e529d2d1d80ba433d4dec9fcbf07506112c8d0a130bed322f03346640456

SHA512
32e48c596def05ddd1c987ae54cb069f750e0e4a993aa9f5c1d69e11c49ca90f6d324dfb4fa7c29c7d642eb2d939b2efe9332e0f4f4cbc5a0b2893adbf8598ec

Download Submit
memory/1812-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/1812-56-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download