97a03a0f92c3446280e811b5f966f367366b00c33611add9d3ffebf69d6139e0

Analysis

max time kernel
44s
max time network
48s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
06/12/2022, 10:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97a03a0f92c3446280e811b5f966f367366b00c33611add9d3ffebf69d6139e0.exe
Size

44KB
MD5

9f53ab717beaddabda54b07009e9e914
SHA1

099de3d4a70b965193319925ded171e95b85b164
SHA256

97a03a0f92c3446280e811b5f966f367366b00c33611add9d3ffebf69d6139e0
SHA512

b05659f54db7ed28feae455fec178b071e04c7fdbf937f737dffb1ab4b338f699fceda1b4d2a99a601841c45c90b9fb0e54a02614018281798d8b895a6efcac4
SSDEEP

768:onUelyIkjbMn1Z1FBZfC+DIJk/qXjxIkjWw:onUeojbMAoCjLjWw

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\WINDOWS\\Config\\csrss.exe"	97a03a0f92c3446280e811b5f966f367366b00c33611add9d3ffebf69d6139e0.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\MSWINSCK.OCX	97a03a0f92c3446280e811b5f966f367366b00c33611add9d3ffebf69d6139e0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\Config\csrss.exe	97a03a0f92c3446280e811b5f966f367366b00c33611add9d3ffebf69d6139e0.exe
File created	C:\WINDOWS\Config\csrss.exe	97a03a0f92c3446280e811b5f966f367366b00c33611add9d3ffebf69d6139e0.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1184	97a03a0f92c3446280e811b5f966f367366b00c33611add9d3ffebf69d6139e0.exe

C:\Users\Admin\AppData\Local\Temp\97a03a0f92c3446280e811b5f966f367366b00c33611add9d3ffebf69d6139e0.exe
"C:\Users\Admin\AppData\Local\Temp\97a03a0f92c3446280e811b5f966f367366b00c33611add9d3ffebf69d6139e0.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1184-54-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1184-55-0x0000000075A11000-0x0000000075A13000-memory.dmp

Filesize
8KB

Download