e036ae5b66f446b921133e33d7b8e9f9aa4acb40aba12a5987150127611bf7fb

Resubmissions

02/07/2023, 11:24

230702-nhn1asbc93 10

02/07/2023, 11:13

230702-nbes2sbc74 10

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20230621-en
resource tags

arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2023, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
Size

1.6MB
MD5

160b58b58d0c37944ad030dc27548c11
SHA1

91f0e5896a9f30cd4294c9389cbbd7572e6264e5
SHA256

e036ae5b66f446b921133e33d7b8e9f9aa4acb40aba12a5987150127611bf7fb
SHA512

104219beea895629976cdf307433b42f7bf3d49bf8a5353eaa3139d970ffd9fe7f909d144b0bcbca57a1525543102dba6a05f24f6ecfb7faa7b8f896adc4f756
SSDEEP

49152:55tLuoO1/5ZGiqE0tixMUsMS5zDCsRXrciTtMJm2/O3YI:zvOl58VdtiDs3JXr7hMJRm3YI

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DC++ Share\TabTip.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\idlj.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\LICLUA.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\java.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCX310F.tmp	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\javac.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\idlj.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jar.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\mip.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\jar.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCX316F.tmp	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCX314F.tmp	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCX30EE.tmp	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javac.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\mip.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\OSE.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCX312F.tmp	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\elevation_service.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
File created	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
4552	ipconfig.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3992	systeminfo.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4792 wrote to memory of 3992	4792	cmd.exe	98
PID 4792 wrote to memory of 3992	4792	cmd.exe	98
PID 4792 wrote to memory of 4552	4792	cmd.exe	110
PID 4792 wrote to memory of 4552	4792	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe
"C:\Users\Admin\AppData\Local\Temp\0761a640d2bd3ec40745af1df8780febf347dff79a89ed3a67b95bf68b59cb9a.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:780

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Windows\system32\systeminfo.exe
  systeminfo
  2⤵
  - Gathers system information
  PID:3992
- C:\Windows\system32\ipconfig.exe
  ipconfig
  2⤵
  - Gathers network information
  PID:4552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DC++ Share\RCX310F.tmp

Filesize
62KB

MD5
b126345317624479f78fbf30b3a1fe5a

SHA1
655c966bf7bbf96ee49c83062d30b9dba17d693c

SHA256
8723d2d97d52f6d3b63968594c93bf2c5b5300b306c9670be4616cb134964301

SHA512
d0be6d608b5f4e482287d16e6587e00be1b4390f78efc3ce63008f99be7358e65f0eef9eba330d845462b64fa7a86cc3f1395b863ad0f8d01c0b790fc2f4c02d

Download Submit
C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

Filesize
1.6MB

MD5
160b58b58d0c37944ad030dc27548c11

SHA1
91f0e5896a9f30cd4294c9389cbbd7572e6264e5

SHA256
e036ae5b66f446b921133e33d7b8e9f9aa4acb40aba12a5987150127611bf7fb

SHA512
104219beea895629976cdf307433b42f7bf3d49bf8a5353eaa3139d970ffd9fe7f909d144b0bcbca57a1525543102dba6a05f24f6ecfb7faa7b8f896adc4f756

Download Submit
memory/780-155-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-160-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-153-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-156-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-157-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-158-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-159-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-154-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-162-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-163-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-152-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-242-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-243-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/780-244-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads