72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3

Analysis

max time kernel
153s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3.exe
Size

2.0MB
MD5

e6d6a6c12c0d2c33850e1df105a231a4
SHA1

c8432caf7c0226d97f033ffc9454cbc0108d87fe
SHA256

72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3
SHA512

e3a0a40991585d33d53f6888345390e0974029d76e11672bc1b25dead8eb9f99e5c820422595cc5739b8cc6e34ff5934425a7ef0837e570e2021321c8c847889
SSDEEP

24576:gptSbkdX6C2UnlB+YVjPDur86XT6gFJS4oJ20T9XCvoqg1gJiB/ufRiE7INNGocy:MdVplB9/ihD6gFJS4oJ2boESNGnC

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\drivers\\csrss.exe"	72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3.exe

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\csrss.exe	72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3.exe
File created	C:\Windows\SysWOW64\drivers\csrss.exe	72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uhook = "C:\\Windows\\system32\\drivers\\csrss.exe"	72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	\??\c:\recycled\desktop.ini	72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1756	72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3.exe

C:\Users\Admin\AppData\Local\Temp\72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3.exe
"C:\Users\Admin\AppData\Local\Temp\72a0119ac982d1fbdd1e24e4ef7458e920d9173e4b35c6f6ac167206d83a54a3.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Adds Run key to start application
- Drops desktop.ini file(s)
- Suspicious use of SetWindowsHookEx
PID:1756

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads