6bf32a69e43c97be65994a8f24b369eaa85d7f9d194d92cfaad35a9f37bab8ff

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1d8b98f417340d9b399a5f9f9944b2e3.exe
Size

744KB
MD5

1d8b98f417340d9b399a5f9f9944b2e3
SHA1

19e4f629d735ac04504510b3a2d6124e654bf883
SHA256

6bf32a69e43c97be65994a8f24b369eaa85d7f9d194d92cfaad35a9f37bab8ff
SHA512

7247b16bbce7038ec7ee2313cd6356f1da0a8c31cfaa40dde53bddd67fee681b2db2aa334901f7b34898bd42fccd1d7b404f2bdfd6ce01a2106c270786a1d9c4
SSDEEP

12288:vfyDxDV00lo3Oxp88Cy1bFKkEgjRFa92VvABc4czAM6CZdUs:nuxC0lwOxp8K1xNVK2VvAPWOw

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	dllhost.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "6625.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "6805.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "7067.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "0573.PIF"	dllhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "1887.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "4556.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "5577.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "3843.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "4723.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "6012.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "2808.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "8003.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "3838.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "2805.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "5538.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "0671.PIF"	dllhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "7167.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "7105.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "0423.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "5156.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "0401.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "3610.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "8065.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "0778.PIF"	dllhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "8150.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "6116.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "8383.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "3477.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "7077.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "2216.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "0104.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "1773.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "7164.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "5460.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "6025.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "setuprs1.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "7854.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "6041.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "0027.PIF"	dllhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "1134.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "4565.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "7714.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe\Debugger = "setuprs1.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "0370.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "2341.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "4117.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "7753.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "7318.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "7210.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "2506.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "7062.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "3668.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "5302.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "8852.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "4512.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "1111.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "0288.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "0625.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "3442.PIF"	dllhost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "1472.PIF"	dllhost.exe

Executes dropped EXE 1 IoCs

pid	Process
1716	dllhost.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\p:	dllhost.exe
File opened (read-only)	\??\m:	dllhost.exe
File opened (read-only)	\??\k:	dllhost.exe
File opened (read-only)	\??\y:	dllhost.exe
File opened (read-only)	\??\q:	dllhost.exe
File opened (read-only)	\??\r:	dllhost.exe
File opened (read-only)	\??\o:	dllhost.exe
File opened (read-only)	\??\l:	dllhost.exe
File opened (read-only)	\??\j:	dllhost.exe
File opened (read-only)	\??\h:	dllhost.exe
File opened (read-only)	\??\e:	dllhost.exe
File opened (read-only)	\??\u:	dllhost.exe
File opened (read-only)	\??\s:	dllhost.exe
File opened (read-only)	\??\n:	dllhost.exe
File opened (read-only)	\??\i:	dllhost.exe
File opened (read-only)	\??\z:	dllhost.exe
File opened (read-only)	\??\x:	dllhost.exe
File opened (read-only)	\??\t:	dllhost.exe
File opened (read-only)	\??\g:	dllhost.exe
File opened (read-only)	\??\w:	dllhost.exe
File opened (read-only)	\??\v:	dllhost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Deleteme.bat	1d8b98f417340d9b399a5f9f9944b2e3.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\setuprs1.PIF	1d8b98f417340d9b399a5f9f9944b2e3.exe
File created	C:\Windows\3666.txt	1d8b98f417340d9b399a5f9f9944b2e3.exe
File opened for modification	C:\Windows\3666.txt	1d8b98f417340d9b399a5f9f9944b2e3.exe
File opened for modification	C:\Windows\setuprs1.PIF	dllhost.exe
File created	C:\Windows\setuprs1.PIF	dllhost.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1752	1d8b98f417340d9b399a5f9f9944b2e3.exe
1752	1d8b98f417340d9b399a5f9f9944b2e3.exe
1752	1d8b98f417340d9b399a5f9f9944b2e3.exe
1752	1d8b98f417340d9b399a5f9f9944b2e3.exe
1716	dllhost.exe
1716	dllhost.exe
1716	dllhost.exe
1716	dllhost.exe
1716	dllhost.exe
1716	dllhost.exe
1716	dllhost.exe
1716	dllhost.exe
1716	dllhost.exe
1716	dllhost.exe
1716	dllhost.exe
1716	dllhost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1752	1d8b98f417340d9b399a5f9f9944b2e3.exe
Token: SeDebugPrivilege	1716	dllhost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 4240	1752	1d8b98f417340d9b399a5f9f9944b2e3.exe	97
PID 1752 wrote to memory of 4240	1752	1d8b98f417340d9b399a5f9f9944b2e3.exe	97
PID 1752 wrote to memory of 4240	1752	1d8b98f417340d9b399a5f9f9944b2e3.exe	97

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "149"	1d8b98f417340d9b399a5f9f9944b2e3.exe

C:\Users\Admin\AppData\Local\Temp\1d8b98f417340d9b399a5f9f9944b2e3.exe
"C:\Users\Admin\AppData\Local\Temp\1d8b98f417340d9b399a5f9f9944b2e3.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Deleteme.bat
  2⤵
  PID:4240

C:\Windows\dllhost.exe
C:\Windows\dllhost.exe -netsvcs
1⤵
- Modifies WinLogon for persistence
- Sets file execution options in registry
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Deleteme.bat

Filesize
184B

MD5
6bb8216f32cb533653e2e534150495af

SHA1
8b26355e76a119576dd9e4a132415c89b603bdc6

SHA256
3d3ed5dc44a6e0bd924b4bd464ed97246d36fad65430711724f16ecb7d006286

SHA512
fee2856b66600ce714ad236abaf4bc17bf17e430933030aecefd25e3d19dd0d2dd7025b15e2b137143c8a0f65862b139383cf088f6bd19b55134bdf11930b8e1

Download Submit
C:\Windows\dllhost.exe

Filesize
744KB

MD5
1d8b98f417340d9b399a5f9f9944b2e3

SHA1
19e4f629d735ac04504510b3a2d6124e654bf883

SHA256
6bf32a69e43c97be65994a8f24b369eaa85d7f9d194d92cfaad35a9f37bab8ff

SHA512
7247b16bbce7038ec7ee2313cd6356f1da0a8c31cfaa40dde53bddd67fee681b2db2aa334901f7b34898bd42fccd1d7b404f2bdfd6ce01a2106c270786a1d9c4

Download Submit
F:\autorun.inf.tmp

Filesize
186B

MD5
388cdce38219e26795c8df2e4b9a8a4c

SHA1
0e72b83417eab223464533d1b749d4bd8a6caa13

SHA256
29eecdb0b3889f3fd97795e770d38455e8af0ca84119dda8e009a123aa527d9b

SHA512
8912302845a77e2d19d0306acdefa1bd55666004eb6240f1d47fceef2ebccf1102fceaf5564de89499106ee03514e6c9ffb82805faaf54be0a9e5f304be0b5b7

Download Submit
memory/1716-84-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-118-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-11-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/1716-36-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-53-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-56-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Filesize
4KB

Download
memory/1716-69-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-248-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-103-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-233-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-133-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-148-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-167-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-182-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-199-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1716-214-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1752-20-0x0000000000400000-0x00000000004C2000-memory.dmp

Filesize
776KB

Download
memory/1752-0-0x0000000000780000-0x0000000000781000-memory.dmp

Filesize
4KB

Download