1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c

Analysis

max time kernel
92s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe
Size

109KB
MD5

d18a843e3f141fcdf8e51978914de485
SHA1

801f01e7e92c1896fa35b3abcf82245bba06ca25
SHA256

1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c
SHA512

616cac5ba3090586f8d98c8820e853083cea730ccbb831b89f4929be669e4dc16237f9fbd3b7e4dd7f17a8345b6ef3e7e7e47eab26fff3bb7260d09af9dd4fe0
SSDEEP

3072:N3om9tHwRQFvBDBgpiIRuZc2m2h5gZY9Xfjk:/3Hwapa/QuYd7k

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility32.dll"	1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe

Loads dropped DLL 1 IoCs

Processes:

svchost.exe

pid process

4320 svchost.exe
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 4.2.2.1

pid	process
4320	svchost.exe

description	ioc
Destination IP	4.2.2.1

Drops file in System32 directory 2 IoCs

Processes:

1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe

description	ioc	process
File created	C:\Windows\SysWOW64\FastUserSwitchingCompatibility32.dll	1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe
File opened for modification	C:\Windows\SysWOW64\FastUserSwitchingCompatibility32.dll	1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe

description	pid	process	target process
PID 4908 wrote to memory of 4280	4908	1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe	cmd.exe
PID 4908 wrote to memory of 4280	4908	1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe	cmd.exe
PID 4908 wrote to memory of 4280	4908	1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe
"C:\Users\Admin\AppData\Local\Temp\1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe"
1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\1045c4c37928da0d93a32ba75a493caad8da8f21eeb69c5e17866489cb2e203c.exe"
2⤵
PID:4280

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
PID:4320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\FastUserSwitchingCompatibility32.dll

Filesize
14KB

MD5
5c87c7d6ade11d68cb8aa8f212010996

SHA1
3cb632ce513ef51c61897a1722696e12fa2a7ef0

SHA256
4988091c1915e065389d060709f0f42e51970629627e1e527bc74c25cc099fc9

SHA512
14094faa28678125d79aa98903faaf1bbcac9fc43ad83a5414543e0938d0ea389328daa415a4e886e8e1c751475c4e06c3e2ea900a2cbebe76a0747a88db6d84

Download Submit
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility32.dll

Filesize
14KB

MD5
5c87c7d6ade11d68cb8aa8f212010996

SHA1
3cb632ce513ef51c61897a1722696e12fa2a7ef0

SHA256
4988091c1915e065389d060709f0f42e51970629627e1e527bc74c25cc099fc9

SHA512
14094faa28678125d79aa98903faaf1bbcac9fc43ad83a5414543e0938d0ea389328daa415a4e886e8e1c751475c4e06c3e2ea900a2cbebe76a0747a88db6d84

Download Submit
memory/4280-139-0x0000000000000000-mapping.dmp

Download
memory/4320-136-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4320-138-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download
memory/4908-132-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4908-133-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4908-137-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download