8d9ec772918c5ee501d18852d93c32767053fbfe7e34a9c11886c1687c290ce8

Analysis

max time kernel
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04-07-2023 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

easyMalicious14a7c34c086f.exe
Size

297KB
MD5

71ece9badf3ec7eab617d495bb94097f
SHA1

14286bf3ec114c5d254e0f2a1f4a68759a4da312
SHA256

8d9ec772918c5ee501d18852d93c32767053fbfe7e34a9c11886c1687c290ce8
SHA512

21ec5d71d3e5f2563f28968431e131c43a941e39df75675823d8111699b814daf15a6412578d32b472d00b674f155f3d526ce7520d7fe8c4ea5719c6cd12cd98
SSDEEP

6144:W731bdBaBHVzdddKaWA2Kj4DrzZ49rFTUd8UyvYznzXVpjU:c1bAGaWZKj0zZyrFT08vCj3jU

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	easyMalicious14a7c34c086f.exe

Drops file in System32 directory 20 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	easyMalicious14a7c34c086f.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	easyMalicious14a7c34c086f.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	easyMalicious14a7c34c086f.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	easyMalicious14a7c34c086f.exe
File created	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	easyMalicious14a7c34c086f.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	easyMalicious14a7c34c086f.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	easyMalicious14a7c34c086f.exe
File created	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	easyMalicious14a7c34c086f.exe
File created	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	easyMalicious14a7c34c086f.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	easyMalicious14a7c34c086f.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	easyMalicious14a7c34c086f.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	easyMalicious14a7c34c086f.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	easyMalicious14a7c34c086f.exe
File created	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	easyMalicious14a7c34c086f.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	easyMalicious14a7c34c086f.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	easyMalicious14a7c34c086f.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	easyMalicious14a7c34c086f.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	easyMalicious14a7c34c086f.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	easyMalicious14a7c34c086f.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	easyMalicious14a7c34c086f.exe

C:\Users\Admin\AppData\Local\Temp\easyMalicious14a7c34c086f.exe
"C:\Users\Admin\AppData\Local\Temp\easyMalicious14a7c34c086f.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:4352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

Filesize
297KB

MD5
71ece9badf3ec7eab617d495bb94097f

SHA1
14286bf3ec114c5d254e0f2a1f4a68759a4da312

SHA256
8d9ec772918c5ee501d18852d93c32767053fbfe7e34a9c11886c1687c290ce8

SHA512
21ec5d71d3e5f2563f28968431e131c43a941e39df75675823d8111699b814daf15a6412578d32b472d00b674f155f3d526ce7520d7fe8c4ea5719c6cd12cd98

Download Submit
memory/4352-152-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-153-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-154-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-155-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-156-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-157-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-158-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-159-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-160-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-161-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-162-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-163-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-164-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-165-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4352-168-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download