7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30

General

Target

7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe
Size

409KB
MD5

7c8ec206d0043df90b7eccf6bd266576
SHA1

b73615aedbafea3d4be7d436e6b88299e5c147f3
SHA256

7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30
SHA512

b7f9a68b71e438425a1673f9dc82403ac8be3ad343657673524817c851728e1595589f94df8fb66c6ae1b23e0c092ee835c8071ab15ec838a66a636a7de71a86
SSDEEP

6144:kIPnx3+QPLWV9MAud5fcq2nES078acb+IYEKskHS/hoEI:jx3+QSV9Ad5f8nES0YacY9DH4W

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow	pid	Process
9	2248	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

Processes:

winlogon.exe

pid	Process
852	winlogon.exe

Loads dropped DLL 1 IoCs

Processes:

taskeng.exe

pid	Process
1632	taskeng.exe

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UPnP\winlogon	rundll32.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe

description	pid	Process	procid_target
PID 1992 set thread context of 2804	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	29
PID 1992 set thread context of 2248	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

rundll32.exe

pid	Process
2248	rundll32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

rundll32.exe

description	pid	Process
Token: SeDebugPrivilege	2248	rundll32.exe
Token: SeRestorePrivilege	2248	rundll32.exe
Token: SeBackupPrivilege	2248	rundll32.exe
Token: SeTakeOwnershipPrivilege	2248	rundll32.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exetaskeng.exe

description	pid	Process	procid_target
PID 1992 wrote to memory of 2804	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	29
PID 1992 wrote to memory of 2804	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	29
PID 1992 wrote to memory of 2804	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	29
PID 1992 wrote to memory of 2804	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	29
PID 1992 wrote to memory of 2804	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	29
PID 1992 wrote to memory of 2248	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	30
PID 1992 wrote to memory of 2248	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	30
PID 1992 wrote to memory of 2248	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	30
PID 1992 wrote to memory of 2248	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	30
PID 1992 wrote to memory of 2248	1992	7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe	30
PID 1632 wrote to memory of 852	1632	taskeng.exe	35
PID 1632 wrote to memory of 852	1632	taskeng.exe	35
PID 1632 wrote to memory of 852	1632	taskeng.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe
"C:\Users\Admin\AppData\Local\Temp\7f5bc615e401caaf9252dbbe0349c59710e9b63efc5a50a0f6dacb0fb06f0b30.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1992
- \??\c:\windows\system32\rundll32.exe
  c:\windows\system32\rundll32.exe
  2⤵
  PID:2804
- \??\c:\windows\system32\rundll32.exe
  c:\windows\system32\rundll32.exe
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2248

C:\Windows\system32\taskeng.exe
taskeng.exe {73AA57FC-3120-4B15-84A1-3C207FA554EB} S-1-5-21-3308111660-3636268597-2291490419-1000:JUBFGPHD\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\winlogon.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\winlogon.exe mNdo0E628Vi3A/aK+LZvSUTvcBDsgbUU3GdwwRmyoWk= fTF6MeWgWzszxbdUPqDjfg==
  2⤵
  - Executes dropped EXE
  PID:852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\winlogon.exe

Filesize
6.0MB

MD5
8946a237072c06f4b0a779444f075caf

SHA1
ca4ba5d29ef9274c76a3b6c7c1fbfc923c57d9c6

SHA256
aa59fb01d1c289c959e179c33e0aa3950de12c40213979a6191d4b1a984abf70

SHA512
3cacb9e3a0456a45a7c773c14c7ea807b58085c441821f1e3078805676cc2bac1950390ca2a63fb842097880a9c9decaf73ae9e7151098c0a0dea6c64e9c6106

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\winlogon.exe

Filesize
5.9MB

MD5
0c572aaba67c0a80607344d2cb38c8c4

SHA1
552e07b97348129748bbe0a31b9687e8fdad09f1

SHA256
2a5a7c00ad5551ae93baf34d823dd48127683f2ed4958d1b17a68ecefd86d246

SHA512
23014dba385901995996a0cada69c23e923b9346c308472e7e71db4c46d5a588957142404cd9f9d1b57ee4fe41b197d06a9d5c5151746a1f42f12eb77c623451

Download Submit
memory/852-35-0x0000000001F30000-0x00000000020E9000-memory.dmp

Filesize
1.7MB

Download
memory/852-37-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/852-38-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/852-36-0x0000000001F30000-0x00000000020E9000-memory.dmp

Filesize
1.7MB

Download
memory/852-34-0x0000000001F30000-0x00000000020E9000-memory.dmp

Filesize
1.7MB

Download
memory/852-33-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2248-28-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-10-0x00000000000E0000-0x000000000010E000-memory.dmp

Filesize
184KB

Download
memory/2248-15-0x00000000002C0000-0x00000000002DE000-memory.dmp

Filesize
120KB

Download
memory/2248-17-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-18-0x000000001A640000-0x000000001A6C0000-memory.dmp

Filesize
512KB

Download
memory/2248-16-0x0000000001C10000-0x0000000001C42000-memory.dmp

Filesize
200KB

Download
memory/2248-20-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

Filesize
9.9MB

Download
memory/2248-21-0x000000001A640000-0x000000001A6C0000-memory.dmp

Filesize
512KB

Download
memory/2248-26-0x0000000002160000-0x00000000021B6000-memory.dmp

Filesize
344KB

Download
memory/2248-27-0x00000000002C0000-0x00000000002DE000-memory.dmp

Filesize
120KB

Download
memory/2804-19-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

Filesize
9.9MB

Download
memory/2804-0-0x0000000000060000-0x0000000000063000-memory.dmp

Filesize
12KB

Download
memory/2804-9-0x000000001ADF0000-0x000000001AE70000-memory.dmp

Filesize
512KB

Download
memory/2804-8-0x000000001ADF0000-0x000000001AE70000-memory.dmp

Filesize
512KB

Download
memory/2804-7-0x000007FEF5F30000-0x000007FEF691C000-memory.dmp

Filesize
9.9MB

Download
memory/2804-6-0x00000000001A0000-0x00000000001A8000-memory.dmp

Filesize
32KB

Download
memory/2804-5-0x0000000000120000-0x000000000013E000-memory.dmp

Filesize
120KB

Download
memory/2804-4-0x0000000000070000-0x000000000008A000-memory.dmp

Filesize
104KB

Download
memory/2804-2-0x0000000000070000-0x000000000008A000-memory.dmp

Filesize
104KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads