11dd22c877190745e1ca9b52720e5a763f36034a4c8390181dcf7dec491a20b7

Analysis

max time kernel
8s
max time network
49s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2022, 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11dd22c877190745e1ca9b52720e5a763f36034a4c8390181dcf7dec491a20b7.exe
Size

272KB
MD5

0162de4e1554435018c1e9a4acb06a60
SHA1

672acbdb140286d502d1e996516709cdb5ff5074
SHA256

11dd22c877190745e1ca9b52720e5a763f36034a4c8390181dcf7dec491a20b7
SHA512

9e4964aedde666469c25bb48fafdab78c33fbd382d2a3b5fec1227135b508bb92f5228464f6904d51ccc92fdaa661d40edf99d912b81e8930997464ff69f948a
SSDEEP

1536:OktvQVgd54vYQ+TO3zzjaBNfnfZKXTVQVgd54v/:OkJL7x1Tszc5fZKXRL7Y

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\winlogon.exe"	11dd22c877190745e1ca9b52720e5a763f36034a4c8390181dcf7dec491a20b7.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\winlogon.exe	11dd22c877190745e1ca9b52720e5a763f36034a4c8390181dcf7dec491a20b7.exe
File opened for modification	C:\Windows\winlogon.exe	11dd22c877190745e1ca9b52720e5a763f36034a4c8390181dcf7dec491a20b7.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
5108	PING.EXE
4644	PING.EXE
3224	PING.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5028	11dd22c877190745e1ca9b52720e5a763f36034a4c8390181dcf7dec491a20b7.exe

C:\Users\Admin\AppData\Local\Temp\11dd22c877190745e1ca9b52720e5a763f36034a4c8390181dcf7dec491a20b7.exe
"C:\Users\Admin\AppData\Local\Temp\11dd22c877190745e1ca9b52720e5a763f36034a4c8390181dcf7dec491a20b7.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping http://www.antiab.150m.com>C:\png.tmp
  2⤵
  PID:1364
- - C:\Windows\SysWOW64\PING.EXE
    ping http://www.antiab.150m.com
    3⤵
    - Runs ping.exe
    PID:5108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping http://www.antiab.150m.com>C:\png.tmp
  2⤵
  PID:4092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping http://www.antiab.150m.com>C:\png.tmp
  2⤵
  PID:3100

C:\Windows\SysWOW64\PING.EXE
ping http://www.antiab.150m.com
1⤵
- Runs ping.exe
PID:4644

C:\Windows\SysWOW64\PING.EXE
ping http://www.antiab.150m.com
1⤵
- Runs ping.exe
PID:3224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\png.tmp

Filesize
99B

MD5
ab2f781ddae11f02efe8564af7367ef4

SHA1
88be50fbae8bba943bfdc688b08dcd012ef807b0

SHA256
e5e154db84bdf453fdb3a35a2e0bc9b92f57b5752bc4b054653f60e1f63ed880

SHA512
64ace23b5c3c234524a7cb3daf57bd4f3edca32e75da06f52a74353867e653afc911f735ff68300fff3899c6c52918429d7036f234424f6d2e2fbda2f62b7151

Download Submit
C:\png.tmp

Filesize
99B

MD5
ab2f781ddae11f02efe8564af7367ef4

SHA1
88be50fbae8bba943bfdc688b08dcd012ef807b0

SHA256
e5e154db84bdf453fdb3a35a2e0bc9b92f57b5752bc4b054653f60e1f63ed880

SHA512
64ace23b5c3c234524a7cb3daf57bd4f3edca32e75da06f52a74353867e653afc911f735ff68300fff3899c6c52918429d7036f234424f6d2e2fbda2f62b7151

Download Submit
memory/5028-134-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download