3aa13f8aadbc54374ee4a383745b1d17d9f33a5afd22464460f0acdf6ca05b47

General

Target

Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
Size

1.1MB
MD5

1bc52f45da01ea2fa4a898b33b8da9bb
SHA1

5bcf7697d0d1ddd948cb68a92c70b358f942deea
SHA256

3aa13f8aadbc54374ee4a383745b1d17d9f33a5afd22464460f0acdf6ca05b47
SHA512

0ecfea1fca52c5c593435793bc78acc48e5b84cdfa18e347ab94a0900e1ec7fbe37ec6ddc2c70fbe81847b72607020d67a0dcbcb17793c7656df7953b5eb2974
SSDEEP

24576:p1b2N67Wx7SsKfSnvgwnc8tbycW7d7u1mxzezX3vErO5eODep/:pwN67q7HJocv1TX3ZEOC

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7z.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File created	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe

C:\Users\Admin\AppData\Local\Temp\Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe
"C:\Users\Admin\AppData\Local\Temp\Easy_Malicious_301a0a4c36576fe9da985d22ed25a74997c8d230d56700cf4ea97f5f46a42533.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

Filesize
1.1MB

MD5
1bc52f45da01ea2fa4a898b33b8da9bb

SHA1
5bcf7697d0d1ddd948cb68a92c70b358f942deea

SHA256
3aa13f8aadbc54374ee4a383745b1d17d9f33a5afd22464460f0acdf6ca05b47

SHA512
0ecfea1fca52c5c593435793bc78acc48e5b84cdfa18e347ab94a0900e1ec7fbe37ec6ddc2c70fbe81847b72607020d67a0dcbcb17793c7656df7953b5eb2974

Download Submit
memory/5060-154-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-155-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-156-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-157-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-158-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-159-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-160-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-161-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-162-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-163-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-164-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-165-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-166-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/5060-167-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads