3a8fdeb39f3f0a2adfefc1e037153bbce88368cf87660530c9504499212d1eb5

Analysis

max time kernel
137s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46cd9ad791190d26c673e485bf7c0c2c.exe
Size

73KB
MD5

46cd9ad791190d26c673e485bf7c0c2c
SHA1

1c7609e268dce61118741ba8f00a483732bf216f
SHA256

3a8fdeb39f3f0a2adfefc1e037153bbce88368cf87660530c9504499212d1eb5
SHA512

da21b3d01d780c7d73d45e0ab4d71976c6f62534ee5903ce096b363e66b516f92fe5143973d89046a7676746dc9507a6b17cc7e2b58586a54339dc52ea987f9d
SSDEEP

1536:NXSv0PZv5LLLLLLLL555vbbPZrrXZLrrrrNGXEypiOCjFp6WLNOKJ8tlzWnLTyvQ:BSv0PZv5LLLLLLLL555vbbPZrrXZLrrb

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\msconfig.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1364	46cd9ad791190d26c673e485bf7c0c2c.exe
2168	explorer.exe
1372	Explorer.EXE
2384	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 848 set thread context of 1364	848	46cd9ad791190d26c673e485bf7c0c2c.exe	28

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1364	46cd9ad791190d26c673e485bf7c0c2c.exe
1364	46cd9ad791190d26c673e485bf7c0c2c.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe
2384	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1364	46cd9ad791190d26c673e485bf7c0c2c.exe
1364	46cd9ad791190d26c673e485bf7c0c2c.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1372	Explorer.EXE
1372	Explorer.EXE
1372	Explorer.EXE
1372	Explorer.EXE
2536	ctfmon.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1372	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2384	svchost.exe
2384	svchost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1364	848	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 848 wrote to memory of 1364	848	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 848 wrote to memory of 1364	848	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 848 wrote to memory of 1364	848	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 848 wrote to memory of 1364	848	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 848 wrote to memory of 1364	848	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 848 wrote to memory of 1364	848	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 848 wrote to memory of 1364	848	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 848 wrote to memory of 1364	848	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 1364 wrote to memory of 2168	1364	46cd9ad791190d26c673e485bf7c0c2c.exe	32
PID 1364 wrote to memory of 2168	1364	46cd9ad791190d26c673e485bf7c0c2c.exe	32
PID 1364 wrote to memory of 2168	1364	46cd9ad791190d26c673e485bf7c0c2c.exe	32
PID 1364 wrote to memory of 2168	1364	46cd9ad791190d26c673e485bf7c0c2c.exe	32
PID 2168 wrote to memory of 1372	2168	explorer.exe	7
PID 1372 wrote to memory of 2384	1372	Explorer.EXE	29
PID 1372 wrote to memory of 2384	1372	Explorer.EXE	29
PID 1372 wrote to memory of 2384	1372	Explorer.EXE	29
PID 1372 wrote to memory of 2384	1372	Explorer.EXE	29
PID 1372 wrote to memory of 2384	1372	Explorer.EXE	29
PID 2384 wrote to memory of 2536	2384	svchost.exe	30
PID 2384 wrote to memory of 2536	2384	svchost.exe	30
PID 2384 wrote to memory of 2536	2384	svchost.exe	30
PID 2384 wrote to memory of 2536	2384	svchost.exe	30

C:\Users\Admin\AppData\Local\Temp\46cd9ad791190d26c673e485bf7c0c2c.exe
"C:\Users\Admin\AppData\Local\Temp\46cd9ad791190d26c673e485bf7c0c2c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\46cd9ad791190d26c673e485bf7c0c2c.exe
  "C:\Users\Admin\AppData\Local\Temp\46cd9ad791190d26c673e485bf7c0c2c.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of WriteProcessMemory
    PID:2168

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\syswow64\svchost.exe
  "C:\Windows\syswow64\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\ctfmon.exe
    ctfmon.exe
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/848-14-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/848-1-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/848-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1364-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1364-16-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1364-15-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1364-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1364-6-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1364-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1364-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1364-19-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1364-21-0x0000000077D90000-0x0000000077D91000-memory.dmp

Filesize
4KB

Download
memory/1364-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1364-57-0x0000000077D90000-0x0000000077D91000-memory.dmp

Filesize
4KB

Download
memory/1364-17-0x0000000077D90000-0x0000000077D91000-memory.dmp

Filesize
4KB

Download
memory/1372-18-0x0000000002A10000-0x0000000002A19000-memory.dmp

Filesize
36KB

Download
memory/2168-24-0x00000000FFCD0000-0x00000000FFF90000-memory.dmp

Filesize
2.8MB

Download
memory/2168-29-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/2384-30-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2384-36-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2384-25-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2384-33-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/2384-61-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download