b92588d07cf65c85dc221808b24bb0e2eb914ffdc94d9e97a38c0bc3aa94b7b7

Analysis

max time kernel
198s
max time network
179s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b92588d07cf65c85dc221808b24bb0e2eb914ffdc94d9e97a38c0bc3aa94b7b7.exe
Size

65KB
MD5

91657a2a36e66bee8b5df435f13ab13d
SHA1

e9fee3e7555d9f3f9b5a11d31156a1eb07572d13
SHA256

b92588d07cf65c85dc221808b24bb0e2eb914ffdc94d9e97a38c0bc3aa94b7b7
SHA512

165d292deb3a0fbb530eafca986fc97305c48f36966a62954784601a08e5f4286036457bd0c195cf3a46e19b4b3b21b5e24cfa0b467f4e03424cce0f3034fcaa
SSDEEP

1536:Vshg8eWZvxJ0CIJb36uzOW9J3qsHdlwcIxulEb:GhaWZvIxOuzxCsHn0ua

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Other.res"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

b92588d07cf65c85dc221808b24bb0e2eb914ffdc94d9e97a38c0bc3aa94b7b7.exesvchost.exe

pid process

1092 b92588d07cf65c85dc221808b24bb0e2eb914ffdc94d9e97a38c0bc3aa94b7b7.exe
1176 svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

svchost.exe

pid	process
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe
1176	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

b92588d07cf65c85dc221808b24bb0e2eb914ffdc94d9e97a38c0bc3aa94b7b7.exe

pid	process
1092	b92588d07cf65c85dc221808b24bb0e2eb914ffdc94d9e97a38c0bc3aa94b7b7.exe
1092	b92588d07cf65c85dc221808b24bb0e2eb914ffdc94d9e97a38c0bc3aa94b7b7.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

svchost.exe

pid process

1176 svchost.exe
1176 svchost.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 1176 wrote to memory of 1352	1176	svchost.exe	ctfmon.exe
PID 1176 wrote to memory of 1352	1176	svchost.exe	ctfmon.exe
PID 1176 wrote to memory of 1352	1176	svchost.exe	ctfmon.exe
PID 1176 wrote to memory of 1352	1176	svchost.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\b92588d07cf65c85dc221808b24bb0e2eb914ffdc94d9e97a38c0bc3aa94b7b7.exe
"C:\Users\Admin\AppData\Local\Temp\b92588d07cf65c85dc221808b24bb0e2eb914ffdc94d9e97a38c0bc3aa94b7b7.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1092

C:\Windows\syswow64\svchost.exe
"C:\Windows\syswow64\svchost.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\SysWOW64\ctfmon.exe
ctfmon.exe
2⤵
PID:1352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-54-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1092-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1092-56-0x00000000002A0000-0x00000000002D0000-memory.dmp

Filesize
192KB

Download
memory/1092-57-0x00000000002A0000-0x00000000002D0000-memory.dmp

Filesize
192KB

Download
memory/1268-59-0x0000000077390000-0x0000000077539000-memory.dmp

Filesize
1.7MB

Download
memory/1268-60-0x0000000002210000-0x0000000002219000-memory.dmp

Filesize
36KB

Download
memory/1352-61-0x0000000000000000-mapping.dmp

Download