fad9ca822985f739ede74bfa2620e306e53e33698479c9f6c87a0bc25883e021

Analysis

max time kernel
43s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e86caabdc0e058c558de7b09cb50ef77d6693548.exe
Size

15KB
MD5

076ed3e227e86884659eae99e53470e4
SHA1

e86caabdc0e058c558de7b09cb50ef77d6693548
SHA256

fad9ca822985f739ede74bfa2620e306e53e33698479c9f6c87a0bc25883e021
SHA512

ec5c97886959f677d62488cb5f87b3d2976790a5d41d9aca0e568f81c6221f32e536254254b091a62e49f6b7adc70b0e4bafc78cf2c772c7128fcace0eb923f9
SSDEEP

384:IB61s7atgXBpP73HBJIPGXe+QYtWS4s45nDrkJpZU1:q7a2Bh7X/IPGXeKL1ePyG

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe syschost.exe s"	e86caabdc0e058c558de7b09cb50ef77d6693548.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{631355B4E1-KAC2IL-O4KGD-S16T4-TQEC72D1O702}\StubPath = "sysver.exe"	e86caabdc0e058c558de7b09cb50ef77d6693548.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{631355B4E1-KAC2IL-O4KGD-S16T4-TQEC72D1O702}	e86caabdc0e058c558de7b09cb50ef77d6693548.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1264	e86caabdc0e058c558de7b09cb50ef77d6693548.exe

C:\Users\Admin\AppData\Local\Temp\e86caabdc0e058c558de7b09cb50ef77d6693548.exe
"C:\Users\Admin\AppData\Local\Temp\e86caabdc0e058c558de7b09cb50ef77d6693548.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Installed Components in the registry
- Suspicious use of SetWindowsHookEx
PID:1264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads