b524cf326dc1e22b84ec310642028e186b465fcbdb2bc3546761b5ad406ff141

Analysis

max time kernel
145s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2ccb65cdd256674c505eac97eaf87f20.exe
Size

321KB
MD5

2ccb65cdd256674c505eac97eaf87f20
SHA1

ab80a02a15c1c90f89a7823cf7d0b50ab4bf079f
SHA256

b524cf326dc1e22b84ec310642028e186b465fcbdb2bc3546761b5ad406ff141
SHA512

02b11460a93d74009766fd0786494e430645c448dbffb87747dd77d9bb7673699d3d1e0ddb36fdafb040255d11159eabf1e35367ce79bdc2026bbfd30a6eecc8
SSDEEP

6144:G0rWgtl2dv7in+52anVRXpPX+zgcVI70NHw+efDSKslmM:G0rWgtGzTX+0aI7KbebXo

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe,C:\\Arquivos de programas\\MuPsNWQt.exe"	2ccb65cdd256674c505eac97eaf87f20.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\system32\drivers\etc\hosts	2ccb65cdd256674c505eac97eaf87f20.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents\MSFS	2ccb65cdd256674c505eac97eaf87f20.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents\MAPI	2ccb65cdd256674c505eac97eaf87f20.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents\IMAIL	2ccb65cdd256674c505eac97eaf87f20.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\OptionalComponents	2ccb65cdd256674c505eac97eaf87f20.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN	2ccb65cdd256674c505eac97eaf87f20.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\winlogn.ini	2ccb65cdd256674c505eac97eaf87f20.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1984	2ccb65cdd256674c505eac97eaf87f20.exe

C:\Users\Admin\AppData\Local\Temp\2ccb65cdd256674c505eac97eaf87f20.exe
"C:\Users\Admin\AppData\Local\Temp\2ccb65cdd256674c505eac97eaf87f20.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1984-0-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/1984-1-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-3-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/1984-4-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-5-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-6-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-7-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-8-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-9-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-10-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-11-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-12-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-13-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-14-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/1984-15-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads