c92484a4db90a84c208565ef3c40fced90648a5a4b03046d4bf7a85e37dfa369

Analysis

max time kernel
63s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07-01-2024 05:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4819b7e3cacf32e9a66c3102d34c661a.exe
Size

64KB
MD5

4819b7e3cacf32e9a66c3102d34c661a
SHA1

e4359b212d28b94c3717116cd9280de2633d651d
SHA256

c92484a4db90a84c208565ef3c40fced90648a5a4b03046d4bf7a85e37dfa369
SHA512

a4ad10bc08a2a8ff43a7952756900a39f74dc274fde0678dabcd5fc5f3e07e23b0c1218969f8ab3c36be2bbb9b56c54b22103091d47fc7ae6940a9b54f2b6b61
SSDEEP

1536:gj2pQQbQqyAf1RnynuvrM66Z18r/GRZF0mOf:M2SQbTn7H41SiZFFO

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\Services\lfmzxq\Parameters\ServiceDll = "%SystemRoot%\\System32\\bsfhsj.dll"	4819b7e3cacf32e9a66c3102d34c661a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\CONTROLSET003\Services\lfmzxq\Parameters\ServiceDll = "%SystemRoot%\\System32\\bsfhsj.dll"	4819b7e3cacf32e9a66c3102d34c661a.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\lfmzxq\Parameters\ServiceDll = "%SystemRoot%\\System32\\bsfhsj.dll"	4819b7e3cacf32e9a66c3102d34c661a.exe

Deletes itself 1 IoCs

pid	Process
4668	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
2240	4819b7e3cacf32e9a66c3102d34c661a.exe
4668	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\0047855.log	4819b7e3cacf32e9a66c3102d34c661a.exe
File created	C:\Windows\SysWOW64\bsfhsj.dll	4819b7e3cacf32e9a66c3102d34c661a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4668	svchost.exe
4668	svchost.exe
4668	svchost.exe

C:\Users\Admin\AppData\Local\Temp\4819b7e3cacf32e9a66c3102d34c661a.exe
"C:\Users\Admin\AppData\Local\Temp\4819b7e3cacf32e9a66c3102d34c661a.exe"
1⤵
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:2240

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k lfmzxq
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\bsfhsj.dll

Filesize
93KB

MD5
35ec1f61b9df6046f41f1b5b7886f3a0

SHA1
b0076087efec7bac22f43db758717524460b4a1e

SHA256
108e0da2ef8c09d1788a9619104f5957262960d28e3671032aad742e223fc104

SHA512
ac2044e00d9e7dd913ed9d2b612b80e1c91007f69b9bcd60c04c1872818278e7fd039c1b5ea5235c68454afbe75698c23a67495fe1fb6b3457b7ce7fd4d9dae5

Download Submit
C:\Windows\SysWOW64\bsfhsj.dll

Filesize
92KB

MD5
d57615524e79ce21a8d00564643cb27b

SHA1
93e403c63ede8fcbc0bd17a77ad443bad28bb709

SHA256
d619df453741b5abe3873e69c40b9af3b5282552e13b6e59e0e2e35ec9b87de8

SHA512
d6483b6dad85e5d20b6e559752a070aa36cfd745eca6c568f9e1c94a5c9c89d9dbda05f4ddc398d0fb58ee7aec7e96257d1c5108d92cbacb094da62404965368

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads