f9f2ff85bb4523a5ebd6e3e66f2d768596d0b52f5e03db62af70b7136c0f9d81

Resubmissions

31/01/2024, 10:08

23/01/2024, 17:50

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23/01/2024, 17:50

Target

CN AOIP-based Comprehensive Regional Architecture (1).docx.exe
Size

1.8MB
MD5

ce33fc3c687d3c01159a8caea7f5482e
SHA1

1d392dc904b7127734a01c83a4cac03065b59897
SHA256

5d75d0ea8bbb5b652f7b72cf728c00322bd486d54a5c4978ceacdf70b4317ee6
SHA512

6406eb57457c06196a31c034e02ae594ad30878159880b78842328b8b9ebba1cdc17abdc2ab410511fa8b5d3546f27d327c694e3a3009dcfd3bbece74da7ef01
SSDEEP

3072:azyBWbuTpOeyp0uTpOMckAKckAGDpA5NlKrss1ywKrss1ySZDvYONDzVFdC5wFVK:azAxF23FukA1kAb0rEbrESZU8wFjNHKC

Score

10^/10

persistence

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, explorer.exe /e,/root,%Pyps% -nop -w h \"Start-Process -N -F $env:Msbd -A $env:Temprd\""	CN AOIP-based Comprehensive Regional Architecture (1).docx.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
2700	SCHTASKS.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2700	1488	CN AOIP-based Comprehensive Regional Architecture (1).docx.exe	19
PID 1488 wrote to memory of 2700	1488	CN AOIP-based Comprehensive Regional Architecture (1).docx.exe	19
PID 1488 wrote to memory of 2700	1488	CN AOIP-based Comprehensive Regional Architecture (1).docx.exe	19

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\CN AOIP-based Comprehensive Regional Architecture (1).docx.exe
"C:\Users\Admin\AppData\Local\Temp\CN AOIP-based Comprehensive Regional Architecture (1).docx.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\system32\SCHTASKS.exe
  SCHTASKS /CREATE /f /TN "OneDriver Reporting Task" /TR "shutdown /l /f" /SC WEEKLY /d TUE,FRI /ST 12:35
  2⤵
  - Creates scheduled task(s)
  PID:2700