3a8fdeb39f3f0a2adfefc1e037153bbce88368cf87660530c9504499212d1eb5

Analysis

max time kernel
141s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
06/01/2024, 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46cd9ad791190d26c673e485bf7c0c2c.exe
Size

73KB
MD5

46cd9ad791190d26c673e485bf7c0c2c
SHA1

1c7609e268dce61118741ba8f00a483732bf216f
SHA256

3a8fdeb39f3f0a2adfefc1e037153bbce88368cf87660530c9504499212d1eb5
SHA512

da21b3d01d780c7d73d45e0ab4d71976c6f62534ee5903ce096b363e66b516f92fe5143973d89046a7676746dc9507a6b17cc7e2b58586a54339dc52ea987f9d
SSDEEP

1536:NXSv0PZv5LLLLLLLL555vbbPZrrXZLrrrrNGXEypiOCjFp6WLNOKJ8tlzWnLTyvQ:BSv0PZv5LLLLLLLL555vbbPZrrXZLrrb

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\msconfig.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1732	46cd9ad791190d26c673e485bf7c0c2c.exe
1692	explorer.exe
1200	Explorer.EXE
2680	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2180 set thread context of 1732	2180	46cd9ad791190d26c673e485bf7c0c2c.exe	28

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1732	46cd9ad791190d26c673e485bf7c0c2c.exe
1732	46cd9ad791190d26c673e485bf7c0c2c.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe
2680	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1732	46cd9ad791190d26c673e485bf7c0c2c.exe
1732	46cd9ad791190d26c673e485bf7c0c2c.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE
2796	ctfmon.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1200	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	svchost.exe
2680	svchost.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1732	2180	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 2180 wrote to memory of 1732	2180	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 2180 wrote to memory of 1732	2180	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 2180 wrote to memory of 1732	2180	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 2180 wrote to memory of 1732	2180	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 2180 wrote to memory of 1732	2180	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 2180 wrote to memory of 1732	2180	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 2180 wrote to memory of 1732	2180	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 2180 wrote to memory of 1732	2180	46cd9ad791190d26c673e485bf7c0c2c.exe	28
PID 1732 wrote to memory of 1692	1732	46cd9ad791190d26c673e485bf7c0c2c.exe	29
PID 1732 wrote to memory of 1692	1732	46cd9ad791190d26c673e485bf7c0c2c.exe	29
PID 1732 wrote to memory of 1692	1732	46cd9ad791190d26c673e485bf7c0c2c.exe	29
PID 1732 wrote to memory of 1692	1732	46cd9ad791190d26c673e485bf7c0c2c.exe	29
PID 1692 wrote to memory of 1200	1692	explorer.exe	11
PID 1200 wrote to memory of 2680	1200	Explorer.EXE	30
PID 1200 wrote to memory of 2680	1200	Explorer.EXE	30
PID 1200 wrote to memory of 2680	1200	Explorer.EXE	30
PID 1200 wrote to memory of 2680	1200	Explorer.EXE	30
PID 1200 wrote to memory of 2680	1200	Explorer.EXE	30
PID 2680 wrote to memory of 2796	2680	svchost.exe	31
PID 2680 wrote to memory of 2796	2680	svchost.exe	31
PID 2680 wrote to memory of 2796	2680	svchost.exe	31
PID 2680 wrote to memory of 2796	2680	svchost.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Users\Admin\AppData\Local\Temp\46cd9ad791190d26c673e485bf7c0c2c.exe
  "C:\Users\Admin\AppData\Local\Temp\46cd9ad791190d26c673e485bf7c0c2c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\46cd9ad791190d26c673e485bf7c0c2c.exe
    "C:\Users\Admin\AppData\Local\Temp\46cd9ad791190d26c673e485bf7c0c2c.exe"
    3⤵
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of WriteProcessMemory
      PID:1692
- C:\Windows\syswow64\svchost.exe
  "C:\Windows\syswow64\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\SysWOW64\ctfmon.exe
    ctfmon.exe
    3⤵
    - Suspicious use of FindShellTrayWindow
    PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-19-0x0000000002610000-0x0000000002619000-memory.dmp

Filesize
36KB

Download
memory/1692-57-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/1692-24-0x00000000FF570000-0x00000000FF830000-memory.dmp

Filesize
2.8MB

Download
memory/1692-27-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/1732-16-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1732-18-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1732-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1732-12-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1732-2-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1732-15-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1732-22-0x0000000077B40000-0x0000000077B41000-memory.dmp

Filesize
4KB

Download
memory/1732-17-0x0000000077B40000-0x0000000077B41000-memory.dmp

Filesize
4KB

Download
memory/1732-6-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1732-8-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1732-4-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2180-1-0x0000000000020000-0x0000000000037000-memory.dmp

Filesize
92KB

Download
memory/2180-0-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2180-14-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2680-30-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2680-25-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2680-33-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/2680-60-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download