8cd530a775727320078c315a232d1e189ba916fa68deb39d0e97b863e9b52f0e

General

Target

Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
Size

1.6MB
MD5

a289b0f6389af856a19d7e12c044e284
SHA1

9fcf65b98373cd5f3fb78913d5b4c6980309800e
SHA256

8cd530a775727320078c315a232d1e189ba916fa68deb39d0e97b863e9b52f0e
SHA512

86f0d42afe19449c30ee1c89e8db0ad4a4d025211b18d4159d299d7daa6b623d29b44c74671ac0349a91c67a14ff6b88864cdf5d0404adb93758b4180d0f3ded
SSDEEP

24576:V1bekvpM4ilGs1ePp6Ew+g26GzDr3uLQV7UsC8REtiMfgNbGCQESHX69lOlZ:VBQcs1Ilw+gezvkS7x6s92XRZ

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File created	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7z.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File created	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File created	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
File created	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe

C:\Users\Admin\AppData\Local\Temp\Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe
"C:\Users\Admin\AppData\Local\Temp\Easy_Malicious_2b7bf900a6f5aacd0ffae838ac46ab135f3f1afb24a7a6ce38345f6dfb808eb6.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

Filesize
1.6MB

MD5
a289b0f6389af856a19d7e12c044e284

SHA1
9fcf65b98373cd5f3fb78913d5b4c6980309800e

SHA256
8cd530a775727320078c315a232d1e189ba916fa68deb39d0e97b863e9b52f0e

SHA512
86f0d42afe19449c30ee1c89e8db0ad4a4d025211b18d4159d299d7daa6b623d29b44c74671ac0349a91c67a14ff6b88864cdf5d0404adb93758b4180d0f3ded

Download Submit
memory/2132-153-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-154-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-155-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-156-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-157-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-158-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-159-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-160-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-161-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-162-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-163-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-164-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-165-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-166-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2132-167-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads