caa45d67aac7c9ecc3ffa03c02196f8c9256af953d29b950eb15654814b04e6c

General

Target

b74a84c75c5e1884254d4b96b149490c_JC.exe
Size

568KB
MD5

b74a84c75c5e1884254d4b96b149490c
SHA1

0911036e5f878f434535edb3d57a5ba02c400804
SHA256

caa45d67aac7c9ecc3ffa03c02196f8c9256af953d29b950eb15654814b04e6c
SHA512

ba5f6763eddccb80dbc973b66fdff943fddce22ecc636b844ad45e5698b5567497c957520b467e29c8107f71bcc61f30258b28482a22b2dbf3c637740d0c8523
SSDEEP

12288:YY9qhYhYoIR7dp0s+x/+i9agoZ8WaIqCQLmZTbjjsJjYxwyv:B97hQRb0s+x+dNopmZDI+7

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	b74a84c75c5e1884254d4b96b149490c_JC.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zG.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InspectorOfficeGadget.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\office2016setup.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OfficeC2RClient.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\OfficeClickToRun.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7z.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\appvcleaner.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\AppVShNotify.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\IntegratedOffice.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\MavInject32.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File created	C:\Windows\SysWOW64\DC++ Share\mip.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\InputPersonalization.exe	b74a84c75c5e1884254d4b96b149490c_JC.exe

C:\Users\Admin\AppData\Local\Temp\b74a84c75c5e1884254d4b96b149490c_JC.exe
"C:\Users\Admin\AppData\Local\Temp\b74a84c75c5e1884254d4b96b149490c_JC.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

Filesize
847KB

MD5
15ec61a1fc6d0cea0816239419af1261

SHA1
502eb7929204fcf60cc35345e12e8a161c45116b

SHA256
093d6b27ea52d71412f1ecf7dacd35be02c8fe3c9d915194f18698c0f15e7887

SHA512
967edc29057089f79695d31fe7aed1a0e6dcd073dcdd4c6369afed68c34d13730de94d39d38cef6551f276e5e74c299f439ad99c1036c6012aae7e25985d9aba

Download Submit
memory/5040-33-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-36-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-4-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-14-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-15-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-25-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-5-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-34-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-28-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-35-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-39-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-40-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-42-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/5040-43-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads