9c982452d0c27774dbd391f57601563150dc44bd66f8b32fa247c8647414363a

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9c982452d0c27774dbd391f57601563150dc44bd66f8b32fa247c8647414363a.exe
Size

57KB
MD5

4b8dfbc2342d9e7659c04b7785267040
SHA1

2eae4441178745e1e0c564f564c51a66b538df20
SHA256

9c982452d0c27774dbd391f57601563150dc44bd66f8b32fa247c8647414363a
SHA512

35026526ac650df0af4af1eaaf10985d581c5e4e0affe76cdcb842696883307899c185a7d72cbce649724454e2284ba3a652289f37d605df8faefd37e3118867
SSDEEP

768:RaI/C5TmILIMTAZD4/WNDrJzEhN1EicI0izTR06wlf7C6MRC98CaUPD4WIzpR:RaAGvPq7fzEhIizTRE2zRCq8b4

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\skype.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2016	9c982452d0c27774dbd391f57601563150dc44bd66f8b32fa247c8647414363a.exe
1160	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
2016	9c982452d0c27774dbd391f57601563150dc44bd66f8b32fa247c8647414363a.exe
2016	9c982452d0c27774dbd391f57601563150dc44bd66f8b32fa247c8647414363a.exe

C:\Users\Admin\AppData\Local\Temp\9c982452d0c27774dbd391f57601563150dc44bd66f8b32fa247c8647414363a.exe
"C:\Users\Admin\AppData\Local\Temp\9c982452d0c27774dbd391f57601563150dc44bd66f8b32fa247c8647414363a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:2016

C:\Windows\syswow64\svchost.exe
"C:\Windows\syswow64\svchost.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-62-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1368-61-0x0000000077A70000-0x0000000077C19000-memory.dmp

Filesize
1.7MB

Download
memory/1368-63-0x0000000002570000-0x0000000002577000-memory.dmp

Filesize
28KB

Download
memory/1368-64-0x0000000077A70000-0x0000000077C19000-memory.dmp

Filesize
1.7MB

Download
memory/2016-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2016-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2016-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2016-57-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2016-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2016-58-0x0000000000020000-0x0000000000034000-memory.dmp

Filesize
80KB

Download
memory/2016-60-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download