6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601

Analysis

max time kernel
35s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30-11-2022 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe
Size

765KB
MD5

ff2641ce33fd64ca3bcdb8f95956ccfc
SHA1

a4b0b0b09d1952f49600fed2b82c15e8452c515d
SHA256

6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601
SHA512

49197ece1e9179326a833cb3a02d6dbfd0fda36dc09bd14a2fa794f735520ac58124626a481a64f4c0a6c733d3cf692f793aa857dffbe662eab9116dd3817038
SSDEEP

1536:oC/6GStcxcG+1SwGp7FUcETgrggggEE2vBgcrZ+HsaJ7FDwwoNGkNecQeRSHcp3z:

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Temp\\6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe\""	6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe

Drops startup file 2 IoCs

Processes:

6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe	6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe	6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\<Unknown> = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe"	6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe"	6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe

C:\Users\Admin\AppData\Local\Temp\6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe
"C:\Users\Admin\AppData\Local\Temp\6af98c9c6ad382f3dddff52c8de96e2f831d0dbb0f1ab0f9a9457ba58d538601.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Adds Run key to start application
PID:2024

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2024-54-0x0000000000B30000-0x0000000000BF2000-memory.dmp

Filesize
776KB

Download
memory/2024-55-0x0000000000350000-0x0000000000374000-memory.dmp

Filesize
144KB

Download
memory/2024-56-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads