eb6e96ed4e56baf9fbefd3ab913e3cb3d0d10d4e9738d86513fe6f862cff0eec

Analysis

max time kernel
93s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 15:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

977da4971afaee750d3b00746b85f52e.dll
Size

116KB
MD5

977da4971afaee750d3b00746b85f52e
SHA1

407cc20cb2af0768865fd93edd4f37c13e5c1660
SHA256

eb6e96ed4e56baf9fbefd3ab913e3cb3d0d10d4e9738d86513fe6f862cff0eec
SHA512

964329abeaa882b94853ff164ac779aad761cbbaaacf475e763ebff3b36ab4c360751abf6086f0b25a6950e552dc56b9801098b2a3d389e3629f222b7c1d99ad
SSDEEP

3072:XY8mq3q28t6mqoVzZBMIiTeos8Qwza0n5DnrgcnU:EYq2C6MCeEQwO0nJr

Score

6^/10

persistence

Malware Config

Signatures

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\977da4971afaee750d3b00746b85f52e\DllName = "C:\\Users\\Admin\\AppData\\Local\\Temp\\977da4971afaee750d3b00746b85f52e.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\977da4971afaee750d3b00746b85f52e\Startup = "WlxStartupEvent"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\977da4971afaee750d3b00746b85f52e\Shutdown = "WlxShutdownEvent"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\977da4971afaee750d3b00746b85f52e\Impersonate = "0"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\977da4971afaee750d3b00746b85f52e\Asynchronous = "0"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\977da4971afaee750d3b00746b85f52e	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\pnrpmsst.exe	rundll32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2460	rundll32.exe
2460	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2460	2988	rundll32.exe	84
PID 2988 wrote to memory of 2460	2988	rundll32.exe	84
PID 2988 wrote to memory of 2460	2988	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\977da4971afaee750d3b00746b85f52e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\977da4971afaee750d3b00746b85f52e.dll,#1
  2⤵
  - Modifies WinLogon
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads