80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683

Analysis

max time kernel
174s
max time network
110s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-12-2022 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe
Size

64KB
MD5

2c270eecea7199f47b769e632608f81e
SHA1

50cf010c103e46c5e593b735d9e43af27fa9a572
SHA256

80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683
SHA512

e2bf41681e68e18786f9f7350efc9035d9ec1eab7cdcbe595b1ec6852cf61939aeae5fed7418ee82f6ec8af03e1ff808f9def798ff402049141ffe0c0aacdd0b
SSDEEP

1536:OK3qHMboLaNmALk7ZZ4wHR8i3et0B0JE7X:t9bbsAQ7ZGwHRsVE7

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\skype.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1608	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe
572	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 1608	1548	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe	28

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe
572	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1608	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe
1608	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
288	ctfmon.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
572	svchost.exe
572	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1608	1548	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe	28
PID 1548 wrote to memory of 1608	1548	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe	28
PID 1548 wrote to memory of 1608	1548	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe	28
PID 1548 wrote to memory of 1608	1548	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe	28
PID 1548 wrote to memory of 1608	1548	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe	28
PID 1548 wrote to memory of 1608	1548	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe	28
PID 1548 wrote to memory of 1608	1548	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe	28
PID 1548 wrote to memory of 1608	1548	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe	28
PID 1548 wrote to memory of 1608	1548	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe	28
PID 1548 wrote to memory of 1608	1548	80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe	28
PID 572 wrote to memory of 288	572	svchost.exe	30
PID 572 wrote to memory of 288	572	svchost.exe	30
PID 572 wrote to memory of 288	572	svchost.exe	30
PID 572 wrote to memory of 288	572	svchost.exe	30

C:\Users\Admin\AppData\Local\Temp\80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe
"C:\Users\Admin\AppData\Local\Temp\80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe
  "C:\Users\Admin\AppData\Local\Temp\80ef1a7c6524f75236c00bc45b29e6ebb184e63599206a9b6af73f633dcf1683.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: MapViewOfSection
  PID:1608

C:\Windows\syswow64\svchost.exe
"C:\Windows\syswow64\svchost.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\SysWOW64\ctfmon.exe
  ctfmon.exe
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/572-70-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1216-69-0x00000000021D0000-0x00000000021D7000-memory.dmp

Filesize
28KB

Download
memory/1216-68-0x00000000773C0000-0x0000000077569000-memory.dmp

Filesize
1.7MB

Download
memory/1548-62-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1608-58-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1608-60-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1608-64-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1608-65-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1608-66-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1608-67-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1608-55-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1608-59-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1608-56-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1608-54-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download