9d455466e0e1ea3c1592f2faf99a2693b975e9e0de2ce925a27cffd869da0be6

Analysis

max time kernel
151s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9d455466e0e1ea3c1592f2faf99a2693b975e9e0de2ce925a27cffd869da0be6.exe
Size

79KB
MD5

00a2a04b9cd370af50c76fb96cf723c0
SHA1

fa36d607f65ed09e5cd1ad5fa0539431278824a9
SHA256

9d455466e0e1ea3c1592f2faf99a2693b975e9e0de2ce925a27cffd869da0be6
SHA512

f715cb8732581b086bd980ad79cbd0c068291c1414925de6a42389008f6fd694456aacbeb42f916e978b2e4abbc129905bb92caf0b7f16dccdec13fcd8e5cabc
SSDEEP

768:PmAYW93G7rhChef/0aoO2JkyrnVZhur1dJ0qUDWKb/24FFNK3BghG1eZZ:eAYW9vgX0aoHJkyXmJp4FoBH1e

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\cache.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1800	9d455466e0e1ea3c1592f2faf99a2693b975e9e0de2ce925a27cffd869da0be6.exe
2032	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1800	9d455466e0e1ea3c1592f2faf99a2693b975e9e0de2ce925a27cffd869da0be6.exe
1800	9d455466e0e1ea3c1592f2faf99a2693b975e9e0de2ce925a27cffd869da0be6.exe

C:\Users\Admin\AppData\Local\Temp\9d455466e0e1ea3c1592f2faf99a2693b975e9e0de2ce925a27cffd869da0be6.exe
"C:\Users\Admin\AppData\Local\Temp\9d455466e0e1ea3c1592f2faf99a2693b975e9e0de2ce925a27cffd869da0be6.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1800

C:\Windows\syswow64\svchost.exe
"C:\Windows\syswow64\svchost.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-58-0x00000000775E0000-0x0000000077789000-memory.dmp

Filesize
1.7MB

Download
memory/1800-54-0x0000000075241000-0x0000000075243000-memory.dmp

Filesize
8KB

Download
memory/1800-55-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1800-56-0x0000000000310000-0x0000000000329000-memory.dmp

Filesize
100KB

Download
memory/1800-57-0x0000000000310000-0x0000000000329000-memory.dmp

Filesize
100KB

Download