7f295a18bd5eca0a4584f31fdf3d567bdfa80f6602dd5819d331f349bf4ba150

General

Target

75098fcc2a67552f7b460586397e28fd.exe
Size

80KB
MD5

75098fcc2a67552f7b460586397e28fd
SHA1

f27e20f7e8031bdfa825642c9ce2f0f1a8ab2a21
SHA256

7f295a18bd5eca0a4584f31fdf3d567bdfa80f6602dd5819d331f349bf4ba150
SHA512

da2021ed4a5a7927278df1f5e1e3413fbf15babcc55d4840bb6200d4c73cf8897621e9aee06e6db54095015902e21c86ba36923eb335b89ed7a613acf72a2e97
SSDEEP

1536:+zWsWHRwXZGZjq+UCh7YEPs6+tVZuvicmEY5:+zyHR6GZjqUhnk5iiWY5

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1940-0-0x0000000013150000-0x0000000013185000-memory.dmp	upx
behavioral1/memory/1216-56-0x0000000013150000-0x0000000013185000-memory.dmp	upx
behavioral1/memory/1216-57-0x0000000013150000-0x0000000013185000-memory.dmp	upx
behavioral1/memory/1216-59-0x0000000013150000-0x0000000013185000-memory.dmp	upx
behavioral1/memory/1216-58-0x0000000013150000-0x0000000013185000-memory.dmp	upx
behavioral1/memory/1216-61-0x0000000013150000-0x0000000013185000-memory.dmp	upx
behavioral1/memory/1216-60-0x0000000013150000-0x0000000013185000-memory.dmp	upx
behavioral1/memory/1216-64-0x0000000013150000-0x0000000013185000-memory.dmp	upx
behavioral1/memory/1216-62-0x0000000013150000-0x0000000013185000-memory.dmp	upx
behavioral1/memory/1216-63-0x0000000013150000-0x0000000013185000-memory.dmp	upx
behavioral1/memory/1216-65-0x0000000013150000-0x0000000013185000-memory.dmp	upx
behavioral1/memory/1940-130-0x0000000013150000-0x0000000013185000-memory.dmp	upx

Modifies WinLogon 2 TTPs 6 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

75098fcc2a67552f7b460586397e28fd.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt	75098fcc2a67552f7b460586397e28fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	75098fcc2a67552f7b460586397e28fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt\StartShell = "Run"	75098fcc2a67552f7b460586397e28fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt\Impersonate = "1"	75098fcc2a67552f7b460586397e28fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt\DLLName = "crypts.dll"	75098fcc2a67552f7b460586397e28fd.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt\Asynchronous = "1"	75098fcc2a67552f7b460586397e28fd.exe

Drops file in System32 directory 1 IoCs

Processes:

75098fcc2a67552f7b460586397e28fd.exe

description ioc process

File created C:\Windows\SysWOW64\crypts.dll 75098fcc2a67552f7b460586397e28fd.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

75098fcc2a67552f7b460586397e28fd.exe

pid process

1940 75098fcc2a67552f7b460586397e28fd.exe

description	ioc	process
File created	C:\Windows\SysWOW64\crypts.dll	75098fcc2a67552f7b460586397e28fd.exe

pid	process
1940	75098fcc2a67552f7b460586397e28fd.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

75098fcc2a67552f7b460586397e28fd.exe

description	pid	process	target process
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE
PID 1940 wrote to memory of 1216	1940	75098fcc2a67552f7b460586397e28fd.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216

C:\Users\Admin\AppData\Local\Temp\75098fcc2a67552f7b460586397e28fd.exe
"C:\Users\Admin\AppData\Local\Temp\75098fcc2a67552f7b460586397e28fd.exe"
2⤵
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1940

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1216-61-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1216-2-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1216-56-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1216-57-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1216-59-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1216-58-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1216-60-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1216-64-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1216-62-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1216-63-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1216-65-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1940-0-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download
memory/1940-130-0x0000000013150000-0x0000000013185000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads