f6c926fee308b55f2410d641587814f0b009d41b2aafd19d6bf81f4ff0a202f3

Analysis

max time kernel
43s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f6c926fee308b55f2410d641587814f0b009d41b2aafd19d6bf81f4ff0a202f3.exe
Size

68KB
MD5

463fbd1e4060b476b9807a855f4c7427
SHA1

3a343ca5d2da38c281925527e2a741491d4769f7
SHA256

f6c926fee308b55f2410d641587814f0b009d41b2aafd19d6bf81f4ff0a202f3
SHA512

2ab3c9c49c949114d46ba1b55441686d767be898361cb1c1849fca470b0e529270efe2c3cba21a321d0910eaf66c9fe6174e34e6d05bddb527f11fa44013d012
SSDEEP

768:qwm2qRQOP9JYz3pBSoU4vabUE+Az2Y+MdjZPbJr50urUA8BXV0XrKCB0W:U2qRQOFJ0BTj0U4zflQHJI0

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe C:\\Windows\\smss.exe"	f6c926fee308b55f2410d641587814f0b009d41b2aafd19d6bf81f4ff0a202f3.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\StartUp\Word.dot	f6c926fee308b55f2410d641587814f0b009d41b2aafd19d6bf81f4ff0a202f3.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\StartUp\Winword.exe	f6c926fee308b55f2410d641587814f0b009d41b2aafd19d6bf81f4ff0a202f3.exe

C:\Users\Admin\AppData\Local\Temp\f6c926fee308b55f2410d641587814f0b009d41b2aafd19d6bf81f4ff0a202f3.exe
"C:\Users\Admin\AppData\Local\Temp\f6c926fee308b55f2410d641587814f0b009d41b2aafd19d6bf81f4ff0a202f3.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download