6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe
Size

83KB
MD5

cdd36c533459172fc96767321528a0e2
SHA1

dd55e6f267f6589fa0da782f213275158e2c905c
SHA256

6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a
SHA512

446fafa5ca48135ad5e5f9ea9aca28f08739d4e58369cb388caa4a5e769951b747d625096a7328342c90eb75192b3ef223e91f14998cef0b6507f5e7b7e8b218
SSDEEP

1536:HhcwHvWy6ZTy/2JR/HI/yXqUQ688oaVRTWTromVjUafLi6M94:yQWyB2nA/yxQGVRaT0oLi6M94

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

svchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\cache.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exesvchost.exe

pid process

832 6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe
2012 svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe

pid	process
832	6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe
832	6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe

C:\Users\Admin\AppData\Local\Temp\6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe
"C:\Users\Admin\AppData\Local\Temp\6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:832

C:\Windows\syswow64\svchost.exe
"C:\Windows\syswow64\svchost.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2012

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/832-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/832-55-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/832-56-0x0000000000240000-0x0000000000259000-memory.dmp

Filesize
100KB

Download
memory/832-57-0x0000000000240000-0x0000000000259000-memory.dmp

Filesize
100KB

Download
memory/1208-58-0x0000000077BF0000-0x0000000077D99000-memory.dmp

Filesize
1.7MB

Download
memory/1208-60-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download
memory/1208-61-0x0000000077BF0000-0x0000000077D99000-memory.dmp

Filesize
1.7MB

Download

pid	process
832	6dc093d21bd95e0881c07eb55ac89fbc9fe3c22b90943ceb38956834e08fde4a.exe
2012	svchost.exe