b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561

Analysis

max time kernel
78s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-12-2022 07:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe
Size

72KB
MD5

74f1fd62fa0476f7067e130172e0b143
SHA1

ebbe72c042364460f78e582acdd4ed833beb7177
SHA256

b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561
SHA512

f3d82a504cd798fe87450a046038b15c37779474218a88457d18e6ce2d7ec566553b9c4cb885ede70d3e47d5fce05755c840f1c66e30642aa14ef5098ba58e91
SSDEEP

768:WxnxLtm2zqVypjPzmRcmHm1kiRpcrmrsUEt4WtKDLOK8su4b1SoWge9Tn3:WxZqVyp+3G1klrrt4WQDLOyuO1RW77

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe"	b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1360-56-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/1360-59-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/1360-60-0x0000000000400000-0x0000000000413000-memory.dmp	upx
behavioral1/memory/1360-61-0x0000000000400000-0x0000000000413000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\S1971754 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe"	b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1512 set thread context of 1360	1512	b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe	27

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1360	b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1360	b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1360	1512	b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe	27
PID 1512 wrote to memory of 1360	1512	b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe	27
PID 1512 wrote to memory of 1360	1512	b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe	27
PID 1512 wrote to memory of 1360	1512	b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe	27
PID 1512 wrote to memory of 1360	1512	b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe	27
PID 1512 wrote to memory of 1360	1512	b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe	27

C:\Users\Admin\AppData\Local\Temp\b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe
"C:\Users\Admin\AppData\Local\Temp\b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe
  C:\Users\Admin\AppData\Local\Temp\b397645cd81b7c89aeee9ca2a4870a60ca245fbd0a5f226280f66a8a3323c561.exe
  2⤵
  - Modifies WinLogon for persistence
  - Adds Run key to start application
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  PID:1360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1360-54-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1360-56-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1360-59-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1360-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1360-61-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads