0a4dd7e8adcf5b8cd725ba15235029d358108c628ecc4622c1fa4c4001d18e2c

General

Target

331ef8f0fe16f62d90c9b21f1fa8cca6.exe
Size

106KB
MD5

331ef8f0fe16f62d90c9b21f1fa8cca6
SHA1

f898af06d5e3247bb366252692f2b324742a57f3
SHA256

0a4dd7e8adcf5b8cd725ba15235029d358108c628ecc4622c1fa4c4001d18e2c
SHA512

7afd9bb68dbde8ede2b3bac6782c38211f2b1b29d7566cd21feb2a0cad4d489232cefddb7ecae0c428869434fdbd12ad663748f45c292474206900526c70fa42
SSDEEP

768:1m/QojCpHfx0nBJeWyTZjwITJeqfYIHwtTJeqfYIdwQBJeWyTZDwxk6SLZRI+WE0:EQoj2tESn5LLI+W5ljT

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	331ef8f0fe16f62d90c9b21f1fa8cca6.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe

Executes dropped EXE 3 IoCs

pid	Process
2468	AE 0124 BE.exe
2140	winlogon.exe
2740	winlogon.exe

Loads dropped DLL 5 IoCs

pid	Process
1452	331ef8f0fe16f62d90c9b21f1fa8cca6.exe
1452	331ef8f0fe16f62d90c9b21f1fa8cca6.exe
2140	winlogon.exe
2140	winlogon.exe
2740	winlogon.exe

Drops autorun.inf file 1 TTPs 26 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\Z:\Autorun.inf	winlogon.exe
File opened for modification	\??\A:\Autorun.inf	winlogon.exe
File opened for modification	C:\Autorun.inf	winlogon.exe
File opened for modification	\??\L:\Autorun.inf	winlogon.exe
File opened for modification	\??\P:\Autorun.inf	winlogon.exe
File opened for modification	\??\Q:\Autorun.inf	winlogon.exe
File opened for modification	\??\S:\Autorun.inf	winlogon.exe
File opened for modification	\??\V:\Autorun.inf	winlogon.exe
File opened for modification	\??\E:\Autorun.inf	winlogon.exe
File opened for modification	F:\Autorun.inf	winlogon.exe
File opened for modification	\??\N:\Autorun.inf	winlogon.exe
File opened for modification	\??\O:\Autorun.inf	winlogon.exe
File opened for modification	\??\R:\Autorun.inf	winlogon.exe
File opened for modification	\??\X:\Autorun.inf	winlogon.exe
File opened for modification	D:\Autorun.inf	winlogon.exe
File opened for modification	\??\U:\Autorun.inf	winlogon.exe
File opened for modification	\??\B:\Autorun.inf	winlogon.exe
File opened for modification	\??\G:\Autorun.inf	winlogon.exe
File opened for modification	\??\H:\Autorun.inf	winlogon.exe
File opened for modification	\??\M:\Autorun.inf	winlogon.exe
File opened for modification	\??\T:\Autorun.inf	winlogon.exe
File opened for modification	\??\I:\Autorun.inf	winlogon.exe
File opened for modification	\??\J:\Autorun.inf	winlogon.exe
File opened for modification	\??\K:\Autorun.inf	winlogon.exe
File opened for modification	\??\W:\Autorun.inf	winlogon.exe
File opened for modification	\??\Y:\Autorun.inf	winlogon.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\Msvbvm60.dll	331ef8f0fe16f62d90c9b21f1fa8cca6.exe
File created	C:\Windows\AE 0124 BE.exe	winlogon.exe
File opened for modification	C:\Windows\Msvbvm60.dll	winlogon.exe
File created	C:\Windows\AE 0124 BE.exe	winlogon.exe
File created	C:\Windows\AE 0124 BE.exe	331ef8f0fe16f62d90c9b21f1fa8cca6.exe
File opened for modification	C:\Windows\AE 0124 BE.exe	331ef8f0fe16f62d90c9b21f1fa8cca6.exe
File opened for modification	C:\Windows\Msvbvm60.dll	331ef8f0fe16f62d90c9b21f1fa8cca6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1452	331ef8f0fe16f62d90c9b21f1fa8cca6.exe
2140	winlogon.exe
2740	winlogon.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2468	1452	331ef8f0fe16f62d90c9b21f1fa8cca6.exe	28
PID 1452 wrote to memory of 2468	1452	331ef8f0fe16f62d90c9b21f1fa8cca6.exe	28
PID 1452 wrote to memory of 2468	1452	331ef8f0fe16f62d90c9b21f1fa8cca6.exe	28
PID 1452 wrote to memory of 2468	1452	331ef8f0fe16f62d90c9b21f1fa8cca6.exe	28
PID 1452 wrote to memory of 2140	1452	331ef8f0fe16f62d90c9b21f1fa8cca6.exe	29
PID 1452 wrote to memory of 2140	1452	331ef8f0fe16f62d90c9b21f1fa8cca6.exe	29
PID 1452 wrote to memory of 2140	1452	331ef8f0fe16f62d90c9b21f1fa8cca6.exe	29
PID 1452 wrote to memory of 2140	1452	331ef8f0fe16f62d90c9b21f1fa8cca6.exe	29
PID 2140 wrote to memory of 2740	2140	winlogon.exe	30
PID 2140 wrote to memory of 2740	2140	winlogon.exe	30
PID 2140 wrote to memory of 2740	2140	winlogon.exe	30
PID 2140 wrote to memory of 2740	2140	winlogon.exe	30

C:\Users\Admin\AppData\Local\Temp\331ef8f0fe16f62d90c9b21f1fa8cca6.exe
"C:\Users\Admin\AppData\Local\Temp\331ef8f0fe16f62d90c9b21f1fa8cca6.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\AE 0124 BE.exe
  "C:\Windows\AE 0124 BE.exe"
  2⤵
  - Executes dropped EXE
  PID:2468
- C:\Windows\SysWOW64\drivers\winlogon.exe
  "C:\Windows\System32\drivers\winlogon.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops autorun.inf file
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\drivers\winlogon.exe
    "C:\Windows\System32\drivers\winlogon.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AE 0124 BE.exe

Filesize
106KB

MD5
331ef8f0fe16f62d90c9b21f1fa8cca6

SHA1
f898af06d5e3247bb366252692f2b324742a57f3

SHA256
0a4dd7e8adcf5b8cd725ba15235029d358108c628ecc4622c1fa4c4001d18e2c

SHA512
7afd9bb68dbde8ede2b3bac6782c38211f2b1b29d7566cd21feb2a0cad4d489232cefddb7ecae0c428869434fdbd12ad663748f45c292474206900526c70fa42

Download Submit
C:\Windows\Msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
25B

MD5
589b6886a49054d03b739309a1de9fcc

SHA1
0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

SHA256
564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

SHA512
4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
106KB

MD5
e0d9e58691049e653bee76d292f4815b

SHA1
cd996b84dc18cbd261e5aa15a226c4f25a0e0bb7

SHA256
465f651389646668cd9693291348f488c3a8b1f7aeb54603ca03408bd0ad05eb

SHA512
128e0cc7c60cca36e67b6fe14dd3dd18a789ea4d220bd4c0ad5c2b43b7305f1c93f8586904dd5fc45acca210b8681e04ce6521830c885190edfc95dcb6bf7539

Download Submit
memory/1452-16-0x0000000002E90000-0x000000000394A000-memory.dmp

Filesize
10.7MB

Download
memory/2140-37-0x0000000002820000-0x00000000032DA000-memory.dmp

Filesize
10.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads