bbf50f162adc2bdf0728c29498455b4fcd5ce544c4c6ac0b1006b5115dfe93c3

Analysis

max time kernel
13s
max time network
17s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 07:31

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

bbf50f162adc2bdf0728c29498455b4fcd5ce544c4c6ac0b1006b5115dfe93c3.exe
Size

92KB
MD5

17b5fa8145fa7f82d695a8f2b30194e2
SHA1

4b6a0577eb403ff71d3389ba12bee4105eb2562e
SHA256

bbf50f162adc2bdf0728c29498455b4fcd5ce544c4c6ac0b1006b5115dfe93c3
SHA512

527e84512bdf9c250c7e9b930d07385a682ad73f5c09e454366ed087702088950921a6773b3cdc5a09c64fc49edae865fd14eef23403266cfd59979c7559296c
SSDEEP

1536:ngOg1TTVWYHxVE3uRwLnNxzeXTUBe0B3yHWuqyuHFq+zCM1ioSJlIU:ngRpTVWMzE3uSLNxzewBJy5qyulq+rin

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\wakcydf.dll	bbf50f162adc2bdf0728c29498455b4fcd5ce544c4c6ac0b1006b5115dfe93c3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1476	bbf50f162adc2bdf0728c29498455b4fcd5ce544c4c6ac0b1006b5115dfe93c3.exe

C:\Users\Admin\AppData\Local\Temp\bbf50f162adc2bdf0728c29498455b4fcd5ce544c4c6ac0b1006b5115dfe93c3.exe
"C:\Users\Admin\AppData\Local\Temp\bbf50f162adc2bdf0728c29498455b4fcd5ce544c4c6ac0b1006b5115dfe93c3.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1476

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:112

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-57-0x000007FEFC311000-0x000007FEFC313000-memory.dmp

Filesize
8KB

Download
memory/1476-54-0x0000000075E51000-0x0000000075E53000-memory.dmp

Filesize
8KB

Download
memory/1476-55-0x0000000001000000-0x0000000001018000-memory.dmp

Filesize
96KB

Download
memory/1476-56-0x0000000001000000-0x0000000001018000-memory.dmp

Filesize
96KB

Download