92568303c5f9880d3c36c8f1e25516f1d51809598394fcc3b39f3cf36afd03d5

Analysis

max time kernel
93s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

__TEMP/LoggingPlatform.dll
Size

603KB
MD5

6c080b38918928b7154f5df346cbf12e
SHA1

fb5d9e15d23d80d014da6a29b2460da29fdfd1bb
SHA256

56ac00856b19b41bc388ecf749eb4651369e7ced0529e9bf422284070de457b6
SHA512

766d556ef60dd1c299d021b1579bf76614f95f469799040a541a938fc5d1e144fc7dfba59fe2526650df47593808fcbffed03e53e3bdcbca8ef1a3fd0e2134a5
SSDEEP

12288:3t9TUeKvC4hvuweW5ZOtd1qEj4D4t2pZIbmyh:3t9NKvC4hvHNyqE24YpZIbDh

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Microsoft.SharePoint.NativeMessagingClient.exe

pid process

956 Microsoft.SharePoint.NativeMessagingClient.exe

pid	process
956	Microsoft.SharePoint.NativeMessagingClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft.SharePoint = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SharepointFiles\\Microsoft.SharePoint.NativeMessagingClient.exe"	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 3328 wrote to memory of 956	3328	rundll32.exe	Microsoft.SharePoint.NativeMessagingClient.exe
PID 3328 wrote to memory of 956	3328	rundll32.exe	Microsoft.SharePoint.NativeMessagingClient.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__TEMP\LoggingPlatform.dll,#1
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3328

C:\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe
"C:\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe"
2⤵
- Executes dropped EXE
PID:956

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe
Filesize
70KB

MD5
ef3179d498793bf4234f708d3be28633

SHA1
dd399ae46303343f9f0da189aee11c67bd868222

SHA256
b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

SHA512
02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

Download Submit