a0f775c08a8e0a603d11b5fa6bca7806c717b91105445f0b84b82d2ab19382bc

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cc25745c544df3eb2a136d5b5fbfe4e.exe
Size

55KB
MD5

3cc25745c544df3eb2a136d5b5fbfe4e
SHA1

00e59310f222734d63a7c269011315b1880e1784
SHA256

a0f775c08a8e0a603d11b5fa6bca7806c717b91105445f0b84b82d2ab19382bc
SHA512

81daf9a8bf08fb05ef6d200f131b5ceca32b9b28ef748e6b35a0475ec287ae1466fd6187786289cf1cb8422c9fb9add0e951e51aa280de1a4de3bae53cf89c58
SSDEEP

1536:KSGRey8H7Dq36CnISCl1N+8hihnPaMRV:lGRa7OVISCkPaU

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\Windows\\system32\\soundfx.com"	3cc25745c544df3eb2a136d5b5fbfe4e.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\soundfx.com	3cc25745c544df3eb2a136d5b5fbfe4e.exe
File opened for modification	C:\Windows\SysWOW64\soundfx.com	3cc25745c544df3eb2a136d5b5fbfe4e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2276	3cc25745c544df3eb2a136d5b5fbfe4e.exe

C:\Users\Admin\AppData\Local\Temp\3cc25745c544df3eb2a136d5b5fbfe4e.exe
"C:\Users\Admin\AppData\Local\Temp\3cc25745c544df3eb2a136d5b5fbfe4e.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:2276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2276-0-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2276-3-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2276-4-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads