bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c

Analysis

max time kernel
10s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe
Size

23KB
MD5

5c3717998906e7d536a9bece11ead7c2
SHA1

12bc4313430f20adcc64a5cb2ab7255e2adbb4e4
SHA256

bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c
SHA512

237dc6b971c33d87814afaf69d7fc2fb4316abfc82b2cae2702283d13f0d0e0ceb72160e8f8f8be1d90037239cba3f9da5c7becac423d797c10bb8542697a231
SSDEEP

384:MqobcA8oZm0nGMniTI4cKj5MKHwflPm4emZwYUUDYwDc1JsnENe3eosKPd/QmC:mbcAzPGMnacKj5FQfdm4DZfvjDc/sQeW

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-3568\\p1898.exe"	bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run	bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\p1887 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-3568\\p1898.exe"	bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-3568\Desktop.ini	bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-3568\\p1898.exe"	bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2040	bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1276	2040	bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe	18
PID 2040 wrote to memory of 1276	2040	bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe	18
PID 2040 wrote to memory of 1276	2040	bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe	18

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276
- C:\Users\Admin\AppData\Local\Temp\bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe
  "C:\Users\Admin\AppData\Local\Temp\bb665bd27aefc0d75ea87229ee8a634a05462b0666b58a69b1602703a780fd5c.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - Drops desktop.ini file(s)
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2040-54-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download
memory/2040-56-0x00000000002B0000-0x00000000002C5000-memory.dmp

Filesize
84KB

Download
memory/2040-55-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download