11584ee2e8367c3785da384ce0938e7a1fba1d4504531e92dc29c197e797f8f5

Analysis

max time kernel
147s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/11/2022, 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11584ee2e8367c3785da384ce0938e7a1fba1d4504531e92dc29c197e797f8f5.exe
Size

73KB
MD5

306a7c218b027e5fdd0f967b2c58cb80
SHA1

dda8b6753a4e344a2a157788f07a2bbb230152f2
SHA256

11584ee2e8367c3785da384ce0938e7a1fba1d4504531e92dc29c197e797f8f5
SHA512

b7c484d1102c0cf963ba8932f23d47dc6521350964522ff9ad7411ebb0f1d57bb9d4b3e244870f0214cf97edd7b9bfaaee8d1227dcd93a51e2c7933fc2cfb4b5
SSDEEP

1536:PxU+sxSinUeZGRm/G7h9T/10m3SQk9EhB:P5YSIUmGmu7h9z10m3SQk9Eh

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\skype.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1808	11584ee2e8367c3785da384ce0938e7a1fba1d4504531e92dc29c197e797f8f5.exe
872	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1808	11584ee2e8367c3785da384ce0938e7a1fba1d4504531e92dc29c197e797f8f5.exe
1808	11584ee2e8367c3785da384ce0938e7a1fba1d4504531e92dc29c197e797f8f5.exe

C:\Users\Admin\AppData\Local\Temp\11584ee2e8367c3785da384ce0938e7a1fba1d4504531e92dc29c197e797f8f5.exe
"C:\Users\Admin\AppData\Local\Temp\11584ee2e8367c3785da384ce0938e7a1fba1d4504531e92dc29c197e797f8f5.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1808

C:\Windows\syswow64\svchost.exe
"C:\Windows\syswow64\svchost.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/872-59-0x00000000751A1000-0x00000000751A3000-memory.dmp

Filesize
8KB

Download
memory/1216-58-0x00000000772E0000-0x0000000077489000-memory.dmp

Filesize
1.7MB

Download
memory/1216-60-0x00000000029C0000-0x00000000029C7000-memory.dmp

Filesize
28KB

Download
memory/1808-55-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1808-54-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1808-56-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1808-57-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download