c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8

Analysis

max time kernel
181s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 05:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe
Size

139KB
MD5

da4c7ecbb9280231127e8284ed13084d
SHA1

07035ced07ba30c23a87f795cf5416530c09b93e
SHA256

c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8
SHA512

8311f1f1fdce8d265c70c7c678c0dd542c5c770488cb844cad203b3583539eb0154fb95f40f4b650e8d46a23f6843836281110313bbcea1b72cc0c0c7beea9c0
SSDEEP

1536:8vU1aQo2Nb5H33VL0Ht/anpLKPajaYERyMHwzFyYKQih1gTGIkw0mV3p4eYG6D0Y:cE5rnsotyYwh1gTGIkwF3pmjD7RFk/0B

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\ProgramData\\sfzodrMz"	c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 392 set thread context of 3004	392	c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe	80

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 392 wrote to memory of 3004	392	c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe	80
PID 392 wrote to memory of 3004	392	c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe	80
PID 392 wrote to memory of 3004	392	c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe	80
PID 392 wrote to memory of 3004	392	c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe	80
PID 392 wrote to memory of 3004	392	c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe	80
PID 392 wrote to memory of 3004	392	c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe	80
PID 392 wrote to memory of 3004	392	c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe	80
PID 392 wrote to memory of 3004	392	c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe	80
PID 392 wrote to memory of 3004	392	c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe	80

C:\Users\Admin\AppData\Local\Temp\c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe
"C:\Users\Admin\AppData\Local\Temp\c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:392
- C:\Users\Admin\AppData\Local\Temp\c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe
  C:\Users\Admin\AppData\Local\Temp\c3204095b8fdf41ff86a139584a1ac8f99ef1b6486f0bdd211c65a5890dfd9e8.exe
  2⤵
  - Modifies WinLogon for persistence
  PID:3004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3004-133-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3004-135-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3004-136-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3004-137-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download