6d4780a417b285bb6bbb7bcedd71cee01d04211c30e3670292f81048f2f02f0b

General

Target

2bfac8f2b1a470cae5490973536e389b.exe
Size

53KB
MD5

2bfac8f2b1a470cae5490973536e389b
SHA1

fae2ee9d9dbda7c26b34a596435204e15fe6ccaa
SHA256

6d4780a417b285bb6bbb7bcedd71cee01d04211c30e3670292f81048f2f02f0b
SHA512

5c6c3fe6976c68a256574fbdd13c1253e7e8d8730c780329ce93eb07292e14a728f6b6dccfa07483732dd384e37c59681de47bd41a73b7ce10995bef17ed2e8c
SSDEEP

768:jWC4zOew4aamt/M2D4+w1NeJ5kbXiHjloRigf/9mwVYdys9e/USIXdslZo4Iq+/q:jWTlxsttD40J06gf/96ysEdsbYUbyV

Score

7^/10

persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000300000001e982-4.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
4276	2bfac8f2b1a470cae5490973536e389b.exe

Modifies WinLogon 2 TTPs 9 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpe32\Asynchronous = "1"	2bfac8f2b1a470cae5490973536e389b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpe32\MaxWait = "1"	2bfac8f2b1a470cae5490973536e389b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	2bfac8f2b1a470cae5490973536e389b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpe32\secureTIME = "2:1"	2bfac8f2b1a470cae5490973536e389b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpe32\DllName = "avpe32.dll"	2bfac8f2b1a470cae5490973536e389b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpe32\Startup = "MmPageFree"	2bfac8f2b1a470cae5490973536e389b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpe32\Impersonate = "1"	2bfac8f2b1a470cae5490973536e389b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpe32	2bfac8f2b1a470cae5490973536e389b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avpe32\secureUID = "[200768872569841536]"	2bfac8f2b1a470cae5490973536e389b.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\qz.dll	2bfac8f2b1a470cae5490973536e389b.exe
File opened for modification	C:\Windows\SysWOW64\avpe64.sys	2bfac8f2b1a470cae5490973536e389b.exe
File created	C:\Windows\SysWOW64\qz.sys	2bfac8f2b1a470cae5490973536e389b.exe
File opened for modification	C:\Windows\SysWOW64\stt82.ini	2bfac8f2b1a470cae5490973536e389b.exe
File created	C:\Windows\SysWOW64\avpe32.dll	2bfac8f2b1a470cae5490973536e389b.exe
File created	C:\Windows\SysWOW64\avpe64.sys	2bfac8f2b1a470cae5490973536e389b.exe
File created	C:\Windows\SysWOW64\stt82.ini	2bfac8f2b1a470cae5490973536e389b.exe
File opened for modification	C:\Windows\SysWOW64\klgcptini.dat	2bfac8f2b1a470cae5490973536e389b.exe
File created	C:\Windows\SysWOW64\qz.dll	2bfac8f2b1a470cae5490973536e389b.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe
4276	2bfac8f2b1a470cae5490973536e389b.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
648	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4276	2bfac8f2b1a470cae5490973536e389b.exe
Token: SeShutdownPrivilege	4276	2bfac8f2b1a470cae5490973536e389b.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4276 wrote to memory of 3528	4276	2bfac8f2b1a470cae5490973536e389b.exe	46
PID 4276 wrote to memory of 3528	4276	2bfac8f2b1a470cae5490973536e389b.exe	46
PID 4276 wrote to memory of 3528	4276	2bfac8f2b1a470cae5490973536e389b.exe	46
PID 4276 wrote to memory of 3528	4276	2bfac8f2b1a470cae5490973536e389b.exe	46
PID 4276 wrote to memory of 3528	4276	2bfac8f2b1a470cae5490973536e389b.exe	46
PID 4276 wrote to memory of 3528	4276	2bfac8f2b1a470cae5490973536e389b.exe	46
PID 4276 wrote to memory of 3528	4276	2bfac8f2b1a470cae5490973536e389b.exe	46

C:\Users\Admin\AppData\Local\Temp\2bfac8f2b1a470cae5490973536e389b.exe
"C:\Users\Admin\AppData\Local\Temp\2bfac8f2b1a470cae5490973536e389b.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4276

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\avpe32.dll

Filesize
38KB

MD5
d4a8a4c65f100afb71e11037bd9d6858

SHA1
4017efbe327f5eb20842faa565a22ae4a83d780d

SHA256
89b8c098781fa4d65331fdb07172ca7a3911e624006e38f1bb8d6129000b1796

SHA512
cc309af5182c692e8a6f671ad20126606aeecd4d98c6ce293b6511b293556d97dd69cb0074412d00025fa3a7473a75c8bde9d4a425c277c3adfe75d9b95a9743

Download Submit
memory/4276-12-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download
memory/4276-15-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/4276-16-0x0000000010000000-0x0000000010050000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads