16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175

Analysis

max time kernel
66s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe
Size

115KB
MD5

d14ba65338b03255b0caf3b40b6bd76b
SHA1

16a261aa344eb9a23ce1090cc024f3f769de7c55
SHA256

16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175
SHA512

872882b6905b2c716faf0e34ae6da0425f9a48bc7a899e62bcf4d66930a13103bf77eba951ee8f930946b60868062f121d81f5d5c10aef484b8f80d8a49b2f87
SSDEEP

1536:eAB6uwU1FiJWT3GmA8oidfSz5TVgdjOb2RADCGAi8AijAi:eAQ/UTyGS8oeYvgdjWrlP8PjP

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\cache.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exesvchost.exe

pid process

276 16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe
688 svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe

pid	process
276	16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe
276	16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe

C:\Users\Admin\AppData\Local\Temp\16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe
"C:\Users\Admin\AppData\Local\Temp\16e23a73c5c7bc6672903c54c5bf75046082338ff8aed03668dee3beefe46175.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:276

C:\Windows\syswow64\svchost.exe
"C:\Windows\syswow64\svchost.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:688

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/276-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/276-55-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/276-56-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/276-57-0x0000000000270000-0x0000000000289000-memory.dmp

Filesize
100KB

Download
memory/1204-58-0x0000000077910000-0x0000000077AB9000-memory.dmp

Filesize
1.7MB

Download
memory/1204-59-0x00000000021E0000-0x00000000021E8000-memory.dmp

Filesize
32KB

Download
memory/1204-61-0x0000000077910000-0x0000000077AB9000-memory.dmp

Filesize
1.7MB

Download