fe2ee25b10ef915068e10c68ed73802b8c5f4659b5f88d1515a82d8c7c9b90dd

Analysis

max time kernel
1s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 23:23

Sharing

Copy URL

Twitter E-mail

Reason

Reading agent response: read tcp 10.127.0.1:49514->10.127.0.129:8000: read: connection reset by peer

Report Analysis Logs

General

Target

fe2ee25b10ef915068e10c68ed73802b8c5f4659b5f88d1515a82d8c7c9b90dd.exe
Size

100KB
MD5

1b9e50831b9bb82044aa66a5036e95e4
SHA1

c20399edae072f54b431b85c760fb926cf6ebdbd
SHA256

fe2ee25b10ef915068e10c68ed73802b8c5f4659b5f88d1515a82d8c7c9b90dd
SHA512

c38c0e1362de07e77935749597e436f47f854caee12261d93077a6811ade7ebc428f81e7753a9b9622b074c53045a6e68403eb286dd2b047f32be669c5ada147
SSDEEP

1536:MWAqIQ4GTyo3/aKmlfsW/lGAS+lNx4aYYxvWqfgoqHYRIA:MWAZQ4Gme/jmlfX/XJ3maYY9Wqfgo2Y

Score

8^/10

persistence

Malware Config

Signatures

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\oihrjdn.dll	fe2ee25b10ef915068e10c68ed73802b8c5f4659b5f88d1515a82d8c7c9b90dd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1840	fe2ee25b10ef915068e10c68ed73802b8c5f4659b5f88d1515a82d8c7c9b90dd.exe

C:\Users\Admin\AppData\Local\Temp\fe2ee25b10ef915068e10c68ed73802b8c5f4659b5f88d1515a82d8c7c9b90dd.exe
"C:\Users\Admin\AppData\Local\Temp\fe2ee25b10ef915068e10c68ed73802b8c5f4659b5f88d1515a82d8c7c9b90dd.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/896-56-0x000007FEFC341000-0x000007FEFC343000-memory.dmp

Filesize
8KB

Download
memory/1840-54-0x0000000076401000-0x0000000076403000-memory.dmp

Filesize
8KB

Download
memory/1840-55-0x0000000001000000-0x000000000101A000-memory.dmp

Filesize
104KB

Download
memory/1840-57-0x0000000001000000-0x000000000101A000-memory.dmp

Filesize
104KB

Download