7a4cbd4d3b5c89ac4d5cfa2f0430e52b8983e94b5411f68eed7c17783a0c098a

Analysis

max time kernel
143s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2023, 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

easyMalicious1817a49a1c1c.exe
Size

495KB
MD5

1af2b2b681e801198758a70a944ff884
SHA1

d2816af76e8f1dd7a8feac17129fc59a82118eb9
SHA256

7a4cbd4d3b5c89ac4d5cfa2f0430e52b8983e94b5411f68eed7c17783a0c098a
SHA512

d098b6a787be3ca9db5085385730918b2684b5525498df37bb903b98d1cd522fceb397dbed164c0e5b5b61f5561eb5ea72f46b4835bf18529bfc70c8deb3500a
SSDEEP

12288:51bJOjfO6mc1ig+7HTP1pGmMpUBsuQAV5psZ:51bJObVigOTfDQUjnVu

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	easyMalicious1817a49a1c1c.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	easyMalicious1817a49a1c1c.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	easyMalicious1817a49a1c1c.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	easyMalicious1817a49a1c1c.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	easyMalicious1817a49a1c1c.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	easyMalicious1817a49a1c1c.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	easyMalicious1817a49a1c1c.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	easyMalicious1817a49a1c1c.exe
File created	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	easyMalicious1817a49a1c1c.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	easyMalicious1817a49a1c1c.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	easyMalicious1817a49a1c1c.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	easyMalicious1817a49a1c1c.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	easyMalicious1817a49a1c1c.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	easyMalicious1817a49a1c1c.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	easyMalicious1817a49a1c1c.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	easyMalicious1817a49a1c1c.exe
File created	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	easyMalicious1817a49a1c1c.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	easyMalicious1817a49a1c1c.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	easyMalicious1817a49a1c1c.exe
File created	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	easyMalicious1817a49a1c1c.exe
File created	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	easyMalicious1817a49a1c1c.exe

C:\Users\Admin\AppData\Local\Temp\easyMalicious1817a49a1c1c.exe
"C:\Users\Admin\AppData\Local\Temp\easyMalicious1817a49a1c1c.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:452

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

Filesize
534KB

MD5
5915628de5612373d18af93fe567c16e

SHA1
398b05929436aca5f8462db446c3672d2d67a9cc

SHA256
075f908765ed546f04589e3f67445165d632545122851a73db6b01b11d3a2eb0

SHA512
ec9db49b2dabdd771a846619e6a37f2e62b56aa3eff519e07e5f94e09379ceb6616491faf37e03f8969ed672198917d79b44ef6e865ebcb600f78275fa4fcd9e

Download Submit
memory/452-153-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-154-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-155-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-156-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-157-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-158-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-159-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-160-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-161-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-162-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-163-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-164-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-166-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/452-167-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download