2849dab99b9d9aac71745604f543131ed119b71a487b1b0247d118c9b632cdda

Analysis

max time kernel
164s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2849dab99b9d9aac71745604f543131ed119b71a487b1b0247d118c9b632cdda.exe
Size

80KB
MD5

6c0f584a92fff74c8a6f30bb32d24f20
SHA1

72616a0b22b3788206b2f37f013e253109ad0358
SHA256

2849dab99b9d9aac71745604f543131ed119b71a487b1b0247d118c9b632cdda
SHA512

451b9781369a0000a444c539d874afdbfe91f44fcfd1bc1764b36dd51ef591cee296541ab4f20ff4c1aacceb446fd1d839611d920af27c79ca767ef46e28658d
SSDEEP

768:5petD9nrhdpKNI7CeurbdRCd9J3f/YJERewHIGrMbcfqH4Dkg/qW1:ParhfvW1dRCd9Nf/9frMbwqYIg/f

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\skype.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1308	2849dab99b9d9aac71745604f543131ed119b71a487b1b0247d118c9b632cdda.exe
1252	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1308	2849dab99b9d9aac71745604f543131ed119b71a487b1b0247d118c9b632cdda.exe
1308	2849dab99b9d9aac71745604f543131ed119b71a487b1b0247d118c9b632cdda.exe

C:\Users\Admin\AppData\Local\Temp\2849dab99b9d9aac71745604f543131ed119b71a487b1b0247d118c9b632cdda.exe
"C:\Users\Admin\AppData\Local\Temp\2849dab99b9d9aac71745604f543131ed119b71a487b1b0247d118c9b632cdda.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1308

C:\Windows\syswow64\svchost.exe
"C:\Windows\syswow64\svchost.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1252

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1208-59-0x00000000772B0000-0x0000000077459000-memory.dmp

Filesize
1.7MB

Download
memory/1208-61-0x0000000002200000-0x0000000002207000-memory.dmp

Filesize
28KB

Download
memory/1308-54-0x0000000075661000-0x0000000075663000-memory.dmp

Filesize
8KB

Download
memory/1308-55-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1308-56-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1308-57-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1308-58-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download