19c618081fd15673b1988d13fceb33db74d401ecd29cc517d5c97e4f8fe0d699

Analysis

max time kernel
141s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2023, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

easyMalicious17a6b23ecd8d.exe
Size

582KB
MD5

a38abb16b318c02e03937e69c4694660
SHA1

c4279f1f736fbd243bb853c13622f3a4241f9f45
SHA256

19c618081fd15673b1988d13fceb33db74d401ecd29cc517d5c97e4f8fe0d699
SHA512

dd3f5aa65c4b96545ce2d3cb1a90dfd2567ed39095f0560f34ed9c3502fe9dc90c891fc475eac1bb9470ec7b7688ee8ae441b530314c83e8ea0744fc9a4882e8
SSDEEP

12288:b1bsKAtAyh4Nz9vzyXKrU6eRbqn0SwJYhjerF42NLogQrSHp5eB:b1bnb97qFRbqn0Nsa+ztIDeB

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	easyMalicious17a6b23ecd8d.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	easyMalicious17a6b23ecd8d.exe
File created	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	easyMalicious17a6b23ecd8d.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	easyMalicious17a6b23ecd8d.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	easyMalicious17a6b23ecd8d.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	easyMalicious17a6b23ecd8d.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	easyMalicious17a6b23ecd8d.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	easyMalicious17a6b23ecd8d.exe
File created	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	easyMalicious17a6b23ecd8d.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	easyMalicious17a6b23ecd8d.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	easyMalicious17a6b23ecd8d.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	easyMalicious17a6b23ecd8d.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	easyMalicious17a6b23ecd8d.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	easyMalicious17a6b23ecd8d.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	easyMalicious17a6b23ecd8d.exe
File created	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	easyMalicious17a6b23ecd8d.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	easyMalicious17a6b23ecd8d.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	easyMalicious17a6b23ecd8d.exe
File created	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	easyMalicious17a6b23ecd8d.exe

C:\Users\Admin\AppData\Local\Temp\easyMalicious17a6b23ecd8d.exe
"C:\Users\Admin\AppData\Local\Temp\easyMalicious17a6b23ecd8d.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:2776

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

Filesize
847KB

MD5
d3ee806d6842d409825e53d4882362d6

SHA1
675647b34a34e2d49c6b7aa724a82e0a70e7ad84

SHA256
842fb810c5cb15aa07472c062e7fa3110138df26fb81586458eea2eb7216ebf8

SHA512
3b1d01ea568f5dad54dcd4099263aa00454b5ff300f9c2460a11f3e2993c1952f0cdbaae5ffd0920bdb0f277b126d878bff1778b0896bc44d804e66fd51d9bc3

Download Submit
memory/2776-150-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-151-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-152-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-153-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-154-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-155-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-156-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-157-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-158-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-159-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-160-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-161-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-162-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2776-165-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download