37182438a8ed1c91a5a063fe33747d3d58519b25f576149537568d83d9cecbff

Analysis

max time kernel
208s
max time network
241s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f95370471e73f81879f6d31feeec209_JC.exe
Size

201KB
MD5

0f95370471e73f81879f6d31feeec209
SHA1

966dca71ef1ef9eada19878d1a3117d893e98c93
SHA256

37182438a8ed1c91a5a063fe33747d3d58519b25f576149537568d83d9cecbff
SHA512

cfbebbc82c7dda01c5f4a5a39e940dc0aa5959a9cfeff3947402f16213954ee689fbc9a5b24fc4074adac7bc1157e997df80f7d2f8a180d78264d828f0d3a3f8
SSDEEP

6144:Ut++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:n+cff22qZhZcKYhc/

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4024	svchost.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\12601974 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\12601974 = "C:\\Windows\\apppatch\\svchost.exe"	0f95370471e73f81879f6d31feeec209_JC.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\vocyzit.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\lymyxid.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\galyqaz.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\puzylyp.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\galyqaz.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\qetyfuv.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\qetyfuv.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\lysyfyj.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\puzylyp.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\vocyzit.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\lymyxid.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\lysyfyj.com	svchost.exe
File created	C:\Program Files (x86)\Windows Defender\vonypom.com	svchost.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\vonypom.com	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	0f95370471e73f81879f6d31feeec209_JC.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	0f95370471e73f81879f6d31feeec209_JC.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4024	svchost.exe
4024	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4320	0f95370471e73f81879f6d31feeec209_JC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4024	4320	0f95370471e73f81879f6d31feeec209_JC.exe	86
PID 4320 wrote to memory of 4024	4320	0f95370471e73f81879f6d31feeec209_JC.exe	86
PID 4320 wrote to memory of 4024	4320	0f95370471e73f81879f6d31feeec209_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\0f95370471e73f81879f6d31feeec209_JC.exe
"C:\Users\Admin\AppData\Local\Temp\0f95370471e73f81879f6d31feeec209_JC.exe"
1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Windows Defender\galyqaz.com

Filesize
40KB

MD5
194ce232dc15668f2e7af813813c22a1

SHA1
a7cb21d903b0854507ad9485f7feb49255336710

SHA256
e0d37a8fada0908e59973e0c5a7d1924bc331db8719e4bb6a6a53c76586fe652

SHA512
30da46f4b25a311fc0ca1e0a1237e9607a447f56cf8e73eea9a9fa41fe249438c4fbbd58085d785244d150d55fa10dcf97a7246023b4ddab37c39d2bd8570d7e

Download Submit
C:\Program Files (x86)\Windows Defender\lysyfyj.com

Filesize
481B

MD5
c2ab51921d3af4de907585e8c3025704

SHA1
463bc3bb708e5e574e0a57b315692241ed765e8b

SHA256
18be504fabebbc9a22c27e4f9975266cb2d12b61d7e68b2a89a22817573a7681

SHA512
a3004a4103c916fff33afe449eb5313ddd7d22f6863f32fd0973c9cf571a7e8e292f297b6744a87b0e946f8758a2f443e522e7bed15886b24e503c9eb74517d0

Download Submit
C:\Program Files (x86)\Windows Defender\puzylyp.com

Filesize
2KB

MD5
4da4adf30154043c15d55df5ca399d20

SHA1
47cc3e3748087b99ece061059aa4c9a721d26f04

SHA256
6e8b4819b8643ece9c851051cbb726ee4824b5dd4bfc87d8e5c3f2ab2b72e863

SHA512
e147473b56130e2b6aa8149993d59566fa74e02c6e49c4dcbcdf9ef9685d0ce6d00bb3c41e155bf11cb0662288730c063aa30326be88361a045607a06b98d962

Download Submit
C:\Windows\apppatch\svchost.exe

Filesize
201KB

MD5
5f8257f669034917f281fbe5e67fcb2f

SHA1
3843f2f92d21eecc060dfef88219279957dfcb5f

SHA256
a0848c95600bc90ce03d2a8a84d2e45b06d2666090a0bf00632fa66d93c77d18

SHA512
cd5a4f1b092f2993b4d08b257dd0a16eb4099d1f10bdf7875f25f9d8c2e6d9de73dee4ef5cec74e5f473af356d0b5e1c83318210b3bc92c9b182be9225a8cbcb

Download Submit
C:\Windows\apppatch\svchost.exe

Filesize
201KB

MD5
5f8257f669034917f281fbe5e67fcb2f

SHA1
3843f2f92d21eecc060dfef88219279957dfcb5f

SHA256
a0848c95600bc90ce03d2a8a84d2e45b06d2666090a0bf00632fa66d93c77d18

SHA512
cd5a4f1b092f2993b4d08b257dd0a16eb4099d1f10bdf7875f25f9d8c2e6d9de73dee4ef5cec74e5f473af356d0b5e1c83318210b3bc92c9b182be9225a8cbcb

Download Submit
C:\Windows\apppatch\svchost.exe

Filesize
201KB

MD5
5f8257f669034917f281fbe5e67fcb2f

SHA1
3843f2f92d21eecc060dfef88219279957dfcb5f

SHA256
a0848c95600bc90ce03d2a8a84d2e45b06d2666090a0bf00632fa66d93c77d18

SHA512
cd5a4f1b092f2993b4d08b257dd0a16eb4099d1f10bdf7875f25f9d8c2e6d9de73dee4ef5cec74e5f473af356d0b5e1c83318210b3bc92c9b182be9225a8cbcb

Download Submit
memory/4024-49-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-52-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-28-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-30-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-32-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-33-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-34-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-35-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-36-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-37-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-39-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-40-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-41-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-42-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-43-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-44-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-46-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-47-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-48-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-45-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-24-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4024-38-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-51-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-26-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-54-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-56-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-62-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-61-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-64-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-66-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-67-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-68-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-69-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-70-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-71-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-72-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-73-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-75-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-76-0x0000000002BD0000-0x0000000002C82000-memory.dmp

Filesize
712KB

Download
memory/4024-21-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4024-23-0x00000000029E0000-0x0000000002A84000-memory.dmp

Filesize
656KB

Download
memory/4320-0-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4320-1-0x00000000021F0000-0x000000000223F000-memory.dmp

Filesize
316KB

Download
memory/4320-2-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download
memory/4320-5-0x00000000021F0000-0x000000000223F000-memory.dmp

Filesize
316KB

Download
memory/4320-17-0x0000000000400000-0x0000000000491000-memory.dmp

Filesize
580KB

Download