9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e

Analysis

max time kernel
42s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18-10-2022 01:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
Size

103KB
MD5

734c9c8c09894ae00b80aceea5100da7
SHA1

9d6aa9f7bc5656f6c89fc3fff4b5ac6625ae9b09
SHA256

9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e
SHA512

cbd44fa2a40e739aaab29147b9fcd60efb7733ef3d2b60db2d6c2f391079779673cd27fa55d440a05eba8ef70549adeb8f79acf3eb38b5dc5e240300e635c05a
SSDEEP

1536:RaiqH1s+kCtrA2UMT0mTFibDKa1AH4ZLE8+oX:o1B31bdBob2QAwLxX

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File created	C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7z.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe

C:\Users\Admin\AppData\Local\Temp\9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe
"C:\Users\Admin\AppData\Local\Temp\9a69fc3d250258202e613731878231d2f99e722ba249b2ac477da90f5cd3033e.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1644-55-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download