bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3

Analysis

max time kernel
159s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe
Size

363KB
MD5

3e1e738044669d8859363af76a61a70d
SHA1

05fe380e80bb34c9866406fb6d95303a0fe7356c
SHA256

bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3
SHA512

2b61dc1f9a350cd909622cba08e3875a3af4a67a149b9a7c3dc9216a2c1fe0c301269bc26fd3947f247705fd1a52992f5ead939194c0bc0cf15c38edb87376b8
SSDEEP

6144:6G1gs+OvrXMGus67ThaWOPCTUYeKyq/N098UmLq98OLg3ZPIW/QnaOhzN3n75:hLcGt63OqTkV92OSZPxfeZL

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4160	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe
4160	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Shutdown = "WinOff2EX"	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Asynchronous = "1"	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Impersonate = "0"	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\DllName = "mdhcp32.dll"	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Startup = "WinStart2EX"	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Logoff = "WinOff2EX"	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\shimg.dll	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe
File created	C:\Windows\SysWOW64\dll.dll	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4160	bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe

C:\Users\Admin\AppData\Local\Temp\bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe
"C:\Users\Admin\AppData\Local\Temp\bb75d889712ea5690c7214cedbc96cf0201c743abd88b357b606ccedb80d70b3.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\mdhcp32.dll

Filesize
48KB

MD5
770012ff1e8606c221efe143396cfa71

SHA1
47c0399fd14ae84a284966cecedcd0e71165e2a4

SHA256
feb19885d9c75c00d498e021559df82a3cd9d720a156e4aae4e6b97d218a0020

SHA512
7e2e1c65cf8afb956f62211f4696e5fa07da8986fe817564fa445819f5e12c57ac1b71e21e14dd9401eb9ea43f89fb1bc558f9b07a8b2668db8e719f1c90754c

Download Submit
C:\Windows\SysWOW64\mdhcp32.dll

Filesize
48KB

MD5
770012ff1e8606c221efe143396cfa71

SHA1
47c0399fd14ae84a284966cecedcd0e71165e2a4

SHA256
feb19885d9c75c00d498e021559df82a3cd9d720a156e4aae4e6b97d218a0020

SHA512
7e2e1c65cf8afb956f62211f4696e5fa07da8986fe817564fa445819f5e12c57ac1b71e21e14dd9401eb9ea43f89fb1bc558f9b07a8b2668db8e719f1c90754c

Download Submit
memory/4160-134-0x0000000002270000-0x0000000002281000-memory.dmp

Filesize
68KB

Download