01549279240d6b4e9be0e296347de0ab7aa06398b9df9da6f6769150cffe20fa

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d5d90237a955a8d91bb58f33e8c4be5.exe
Size

94KB
MD5

0d5d90237a955a8d91bb58f33e8c4be5
SHA1

78de4e956d2ab08347306caa9ac0c353aae25249
SHA256

01549279240d6b4e9be0e296347de0ab7aa06398b9df9da6f6769150cffe20fa
SHA512

bee2eb4e0c0a21c2c8e4145ff83d5968533517afb39227ed8c35b72cf434b75a9fe3b3077436bb6d5db857bbb9b72f6dc85b581beefa047b5b65a859103cc7eb
SSDEEP

768:Khfk3b1h2eA/FxVj/g8clphm88KGINklOhqpUUqiZX4VxV+3A:EJ5cphmvKHkZiUqVz+w

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\cliconfgzx.dll = "{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}"	0d5d90237a955a8d91bb58f33e8c4be5.exe

Deletes itself 1 IoCs

pid	Process
2568	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1672	0d5d90237a955a8d91bb58f33e8c4be5.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\cliconfgzx.tmp	0d5d90237a955a8d91bb58f33e8c4be5.exe
File opened for modification	C:\Windows\SysWOW64\cliconfgzx.tmp	0d5d90237a955a8d91bb58f33e8c4be5.exe
File opened for modification	C:\Windows\SysWOW64\cliconfgzx.nls	0d5d90237a955a8d91bb58f33e8c4be5.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}	0d5d90237a955a8d91bb58f33e8c4be5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32	0d5d90237a955a8d91bb58f33e8c4be5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ = "C:\\Windows\\SysWow64\\cliconfgzx.dll"	0d5d90237a955a8d91bb58f33e8c4be5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7A6DF30E-D0F2-446f-B4F0-BF4232D60E07}\InProcServer32\ThreadingModel = "Apartment"	0d5d90237a955a8d91bb58f33e8c4be5.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1672	0d5d90237a955a8d91bb58f33e8c4be5.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1672	0d5d90237a955a8d91bb58f33e8c4be5.exe
1672	0d5d90237a955a8d91bb58f33e8c4be5.exe
1672	0d5d90237a955a8d91bb58f33e8c4be5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 2568	1672	0d5d90237a955a8d91bb58f33e8c4be5.exe	28
PID 1672 wrote to memory of 2568	1672	0d5d90237a955a8d91bb58f33e8c4be5.exe	28
PID 1672 wrote to memory of 2568	1672	0d5d90237a955a8d91bb58f33e8c4be5.exe	28
PID 1672 wrote to memory of 2568	1672	0d5d90237a955a8d91bb58f33e8c4be5.exe	28

C:\Users\Admin\AppData\Local\Temp\0d5d90237a955a8d91bb58f33e8c4be5.exe
"C:\Users\Admin\AppData\Local\Temp\0d5d90237a955a8d91bb58f33e8c4be5.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\8315.tmp.bat
  2⤵
  - Deletes itself
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8315.tmp.bat

Filesize
179B

MD5
b1feffb53946880f79e2e8955db7297d

SHA1
2ba3e35fafcb9599ce20b6c351a4e49ac3981e46

SHA256
927fbbe08704c72eb6e3fc9d6746fef5bb12f3fbe62986ddb33be17e7362d70a

SHA512
89e09e48e7c689b889356a0168a200990fdfcc61b135aacfd96a693eea9084d5837e74ff505072ababb37fbf419fc58c94a425c34099307df52680b565c14a2b

Download Submit
C:\Windows\SysWOW64\cliconfgzx.tmp

Filesize
953KB

MD5
d783bad65e04917294c4d922e169093f

SHA1
9b100681986d0bb1719662b5cbfe7f0cc73e6de9

SHA256
7a0d7e6a13d098fceaaf4bb1683aeae1e547a0d60cdb8c827814936a750fc56a

SHA512
39ec5d6f7ad903b3ffc96b6a452d653d6943378fc62d9c37ae4346268cd8d252a98b457cebc8284fa6453c6d9047a8f941873b2d330a4da6564ba36d0779e4c8

Download Submit
memory/1672-8-0x0000000020000000-0x000000002000A000-memory.dmp

Filesize
40KB

Download
memory/1672-17-0x0000000020000000-0x000000002000A000-memory.dmp

Filesize
40KB

Download