77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc

Analysis

max time kernel
168s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe
Size

435KB
MD5

387050f87fe3ff8dbedf3c097233a710
SHA1

3d060c5c5065e44652a59d405ff4754bc88ba426
SHA256

77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc
SHA512

645af124b2fcfed670c00ec9ab2a53964077936c32d1df5091310eca9075dc955465257f8b23358792c031e3348a453e7b6a4f3b31d175a4d9e4b98bc785cb56
SSDEEP

3072:TSWVa1rLfhE9vDH8/Wg1kuWZyxOvxQggjbdRYEX+RotB5:fVa1rLhAeKuWZyxOqXjGsL

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4276	sysmgr.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4"	sysmgr.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	sysmgr.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	sysmgr.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	sysmgr.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	sysmgr.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	sysmgr.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	sysmgr.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	sysmgr.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	sysmgr.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	sysmgr.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	sysmgr.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	sysmgr.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\sysmgr.exe	77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe
File created	C:\Windows\svc.dat	77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe
File opened for modification	C:\Windows\conf.dat	sysmgr.exe
File created	C:\Windows\conf.dat	sysmgr.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4276	3208	77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe	81
PID 3208 wrote to memory of 4276	3208	77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe	81
PID 3208 wrote to memory of 4276	3208	77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe	81

C:\Users\Admin\AppData\Local\Temp\77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe
"C:\Users\Admin\AppData\Local\Temp\77f45b143ed15c3ff755ccb0c83d540442abd21374a93650569fdd270e3f80cc.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\sysmgr.exe
  "C:\Windows\sysmgr.exe"
  2⤵
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:4276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\svc.dat

Filesize
2KB

MD5
8824722f1793fb0667bfd1605cff2e69

SHA1
9c130032d78bb6e9848dc9c8d48552a3de6c48e7

SHA256
693fb2a7bc8417cd442582e97b8f732143478b6ad7a916288478b206c916cddf

SHA512
7b6247e2eaecdac463d433f362c4a472527198aa4a44481ad46f64dedf32b85a623cbe0d7c73076bef41b166780f1b2f1751d20e81c48e048fb9e97bd7c65878

Download Submit
C:\Windows\sysmgr.exe

Filesize
36KB

MD5
2373dfbdba70b54164d4fe163f7f59f1

SHA1
fbc51778f9e4868ddce4763d0bef4cb48090e3f6

SHA256
e506e529d2d1d80ba433d4dec9fcbf07506112c8d0a130bed322f03346640456

SHA512
32e48c596def05ddd1c987ae54cb069f750e0e4a993aa9f5c1d69e11c49ca90f6d324dfb4fa7c29c7d642eb2d939b2efe9332e0f4f4cbc5a0b2893adbf8598ec

Download Submit
C:\Windows\sysmgr.exe

Filesize
36KB

MD5
2373dfbdba70b54164d4fe163f7f59f1

SHA1
fbc51778f9e4868ddce4763d0bef4cb48090e3f6

SHA256
e506e529d2d1d80ba433d4dec9fcbf07506112c8d0a130bed322f03346640456

SHA512
32e48c596def05ddd1c987ae54cb069f750e0e4a993aa9f5c1d69e11c49ca90f6d324dfb4fa7c29c7d642eb2d939b2efe9332e0f4f4cbc5a0b2893adbf8598ec

Download Submit
memory/3208-132-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/3208-135-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download