cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4

General

Target

cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe
Size

140KB
MD5

c230a5f05971efdd3e67588a9a6c5734
SHA1

d8bce9b564cb280e68255d79b0ec5854379e49fb
SHA256

cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4
SHA512

be64cce8149fbf888efa014f2a9179a1713997c51902e546c947c69debcd8cd3556c8e1840f11c30ded7ee754e87a7e29e77eb35a6d3b3949e0a8d010e965f18
SSDEEP

768:SC3Hez0wTTMEMHqmglzK7q01WbfU/s/5QH+r4:hXrwTwEMilu7qIWbfUU/nr4

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1830\\zaberg.exe"	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\zaber0 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1830\\zaberg.exe"	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-1830\Desktop.ini	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-1830\\zaberg.exe"	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2016 set thread context of 1080	2016	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	26

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1080	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1080	2016	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	26
PID 2016 wrote to memory of 1080	2016	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	26
PID 2016 wrote to memory of 1080	2016	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	26
PID 2016 wrote to memory of 1080	2016	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	26
PID 2016 wrote to memory of 1080	2016	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	26
PID 2016 wrote to memory of 1080	2016	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	26
PID 2016 wrote to memory of 1080	2016	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	26
PID 2016 wrote to memory of 1080	2016	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	26
PID 2016 wrote to memory of 1080	2016	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	26
PID 1080 wrote to memory of 1368	1080	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	6
PID 1080 wrote to memory of 1368	1080	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	6
PID 1080 wrote to memory of 1368	1080	cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe	6

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1368
- C:\Users\Admin\AppData\Local\Temp\cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe
  "C:\Users\Admin\AppData\Local\Temp\cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Users\Admin\AppData\Local\Temp\cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe
    "C:\Users\Admin\AppData\Local\Temp\cdf93faf6e3e22b3c0228cfbf54bb8637124a8c1735ddb075eeb79c2dbd78ce4.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Adds Run key to start application
    - Drops desktop.ini file(s)
    - Modifies WinLogon
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1080

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1080-54-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1080-55-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1080-57-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1080-58-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1080-59-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1080-63-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2016-62-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads