f4d28d86603e244c0c980cef7c8c529d8cd1dae1532745e3ac47c5aa35d1c550

Analysis

max time kernel
153s
max time network
29s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
04-07-2023 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

easyMalicious17734565668a.exe
Size

155KB
MD5

9544bb6e39178a3fb55329f65fd4d186
SHA1

4006627f808868ba901f8a10828d72661180af19
SHA256

f4d28d86603e244c0c980cef7c8c529d8cd1dae1532745e3ac47c5aa35d1c550
SHA512

ca4c706d8160bdcf8d54f5c5a2335064eb1efdaade168ebb20c7e83023fea10682cb1ff209d512f2e4c5c1fbebb332ddaf88121a8d64ec58db8629bebfad9d78
SSDEEP

3072:t1B31bdBob2QXcLAb3ITW5qsiMUfuPFaKkTeULi3mwhMqzegqWJ:t731bdBaBfbYGiMUfGkiNBeI

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	easyMalicious17734565668a.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\setup.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\apt.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\idlj.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\javac.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\javaws.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\idlj.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXAA86.tmp	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\apt.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\setup.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\mip.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrome.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXAAE6.tmp	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXA9B8.tmp	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXAAA6.tmp	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javac.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXAA46.tmp	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jar.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXAA26.tmp	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\javah.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javap.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_proxy.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	easyMalicious17734565668a.exe
File created	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\RCXAB45.tmp	easyMalicious17734565668a.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	easyMalicious17734565668a.exe

C:\Users\Admin\AppData\Local\Temp\easyMalicious17734565668a.exe
"C:\Users\Admin\AppData\Local\Temp\easyMalicious17734565668a.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:1212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\DC++ Share\extcheck.exe

Filesize
78KB

MD5
7826b3b862cbec1ad33f1dd614fdc808

SHA1
919b539b8691c69a29b59bd46834b9d6377b99da

SHA256
8774ea71f63f8ed585afb1f1be90acfaf46e5639dadcc74e749cc6846db20781

SHA512
e742aaed9fc067800fda30049299988cb354d2a23940a94615c95a4ab752b413ba16af99aa522dd2bb17276b1cfbaef0a3c880805388b53ba13783be067fd473

Download Submit
C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

Filesize
847KB

MD5
cbc52dbabe7f28b4a0c6dc4e3cb94aa0

SHA1
06aea92532879e7a5f11ae91a252cb0fd70caa86

SHA256
df052e35d37ae5350499894847969e89fd672771eb6ac55a17a20949415dc1d6

SHA512
df8429c7940ff44a0febaebbce3c69fd0d97c6bcf4fae101d4388f155f5b51246078e1542ae5e6a555c581a08bac3cf74554d3ec20980247e7e60f5456f81121

Download Submit
memory/1212-178-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-179-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-174-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-175-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-176-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-177-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-84-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-173-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-180-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-181-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-182-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-183-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-184-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-185-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1212-186-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download