92568303c5f9880d3c36c8f1e25516f1d51809598394fcc3b39f3cf36afd03d5

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

__TEMP/LoggingPlatform.dll
Size

603KB
MD5

6c080b38918928b7154f5df346cbf12e
SHA1

fb5d9e15d23d80d014da6a29b2460da29fdfd1bb
SHA256

56ac00856b19b41bc388ecf749eb4651369e7ced0529e9bf422284070de457b6
SHA512

766d556ef60dd1c299d021b1579bf76614f95f469799040a541a938fc5d1e144fc7dfba59fe2526650df47593808fcbffed03e53e3bdcbca8ef1a3fd0e2134a5
SSDEEP

12288:3t9TUeKvC4hvuweW5ZOtd1qEj4D4t2pZIbmyh:3t9NKvC4hvHNyqE24YpZIbDh

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Microsoft.SharePoint.NativeMessagingClient.exe

pid process

3064 Microsoft.SharePoint.NativeMessagingClient.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1728 rundll32.exe

pid	process
3064	Microsoft.SharePoint.NativeMessagingClient.exe

pid	process
1728	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft.SharePoint = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SharepointFiles\\Microsoft.SharePoint.NativeMessagingClient.exe"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1728 wrote to memory of 3064	1728	rundll32.exe	Microsoft.SharePoint.NativeMessagingClient.exe
PID 1728 wrote to memory of 3064	1728	rundll32.exe	Microsoft.SharePoint.NativeMessagingClient.exe
PID 1728 wrote to memory of 3064	1728	rundll32.exe	Microsoft.SharePoint.NativeMessagingClient.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__TEMP\LoggingPlatform.dll,#1
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1728

C:\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe
"C:\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe"
2⤵
- Executes dropped EXE
PID:3064

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe
Filesize
44KB

MD5
dd81d91ff3b0763c392422865c9ac12e

SHA1
963b55acc8c566876364716d5aafa353995812a8

SHA256
f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9

SHA512
8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads