eb0cfa34136dd25f9a9144cba445388111d4e06ad1a366af4e1c9ef425df51e3

Analysis

max time kernel
63s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11dcdda3b680235e7d88b07a36a92a8b.exe
Size

1.8MB
MD5

11dcdda3b680235e7d88b07a36a92a8b
SHA1

a0fdda8d94c54b9681452370f094a59fedf582ec
SHA256

eb0cfa34136dd25f9a9144cba445388111d4e06ad1a366af4e1c9ef425df51e3
SHA512

8a71239b525460def17443884c1b63ab3a56ea56a7e916dfb62532d9f58d7fbff8ddbeb5d9918e9f4ee4216224eb20a557e8e698134eab06a182b2ed8aa9abe6
SSDEEP

49152:nyFSmO4gig06vtchcL6yUw4gZ2oe7yUFHn:nyfdgiJ6FHL7q

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\APManager\\apmanager.exe"	11dcdda3b680235e7d88b07a36a92a8b.exe

Executes dropped EXE 1 IoCs

pid	Process
2444	apmanager.exe

Loads dropped DLL 4 IoCs

pid	Process
2044	11dcdda3b680235e7d88b07a36a92a8b.exe
2044	11dcdda3b680235e7d88b07a36a92a8b.exe
2444	apmanager.exe
2444	apmanager.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\apmanager.exe = "C:\\Users\\Admin\\AppData\\Roaming\\APManager\\apmanager.exe silent"	11dcdda3b680235e7d88b07a36a92a8b.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2444	apmanager.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2444	2044	11dcdda3b680235e7d88b07a36a92a8b.exe	20
PID 2044 wrote to memory of 2444	2044	11dcdda3b680235e7d88b07a36a92a8b.exe	20
PID 2044 wrote to memory of 2444	2044	11dcdda3b680235e7d88b07a36a92a8b.exe	20
PID 2044 wrote to memory of 2444	2044	11dcdda3b680235e7d88b07a36a92a8b.exe	20
PID 2044 wrote to memory of 2444	2044	11dcdda3b680235e7d88b07a36a92a8b.exe	20
PID 2044 wrote to memory of 2444	2044	11dcdda3b680235e7d88b07a36a92a8b.exe	20
PID 2044 wrote to memory of 2444	2044	11dcdda3b680235e7d88b07a36a92a8b.exe	20

C:\Users\Admin\AppData\Local\Temp\11dcdda3b680235e7d88b07a36a92a8b.exe
"C:\Users\Admin\AppData\Local\Temp\11dcdda3b680235e7d88b07a36a92a8b.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Roaming\APManager\apmanager.exe
  C:\Users\Admin\AppData\Roaming\APManager\apmanager.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Roaming\APManager\apmanager.exe

Filesize
92KB

MD5
ffabcb2d3f5611aede88e62f382f5b03

SHA1
369515f39f76d5e0d039600fa56092038cf5d9b3

SHA256
7f6503bfc09651defedc0e9559fc873750ce5c96916bcb50764c2927bf0ef619

SHA512
37cf0bc68d43b53d16ae3918b89b74eb53734a892a75150e6a8bf78f25c4f72a755d367fd63a43eb9f731dd8f54baecb49e43230dd9e6d6355d345592537baf9

Download Submit
memory/2444-28-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download
memory/2444-32-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download
memory/2444-34-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download
memory/2444-38-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download
memory/2444-39-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download