92568303c5f9880d3c36c8f1e25516f1d51809598394fcc3b39f3cf36afd03d5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

__TEMP/wtsapi32.dll
Size

114KB
MD5

86b0aaf254435d2373190c5722b434c0
SHA1

8e418cd6c8c3797cbd0368e5b68c215a452fcefb
SHA256

27fc518c588175bc19e4379b90eda0e071b847254ea0701f02f1ccd945ca280f
SHA512

0381fa560389f2add8c426e61e80e297e3cfa224733257dbe3c605a78e79725b48c6ddf639294064b550145d8aad0cb0c8c13d0b909a57ad85c9a8e2cc446ec6
SSDEEP

1536:QOVM6xTEQhLHyIgSBTjSEpECC0j3Vm2XJD3sWvd09dlnSyGsqENz:DVMAEQFPdTjhpPDj3VBRbM1ysqENz

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Microsoft.SharePoint.NativeMessagingClient.exe

pid process

2000 Microsoft.SharePoint.NativeMessagingClient.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2948 rundll32.exe

pid	process
2000	Microsoft.SharePoint.NativeMessagingClient.exe

pid	process
2948	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft.SharePoint = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SharepointFiles\\Microsoft.SharePoint.NativeMessagingClient.exe"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2948 wrote to memory of 2000	2948	rundll32.exe	Microsoft.SharePoint.NativeMessagingClient.exe
PID 2948 wrote to memory of 2000	2948	rundll32.exe	Microsoft.SharePoint.NativeMessagingClient.exe
PID 2948 wrote to memory of 2000	2948	rundll32.exe	Microsoft.SharePoint.NativeMessagingClient.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__TEMP\wtsapi32.dll,#1
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2948

C:\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe
"C:\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe"
2⤵
- Executes dropped EXE
PID:2000

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe
Filesize
44KB

MD5
dd81d91ff3b0763c392422865c9ac12e

SHA1
963b55acc8c566876364716d5aafa353995812a8

SHA256
f5691b8f200e3196e6808e932630e862f8f26f31cd949981373f23c9d87db8b9

SHA512
8a5036ccab9c9e71deb4ecb9598528ca19c2d697a836846d23e1547b24172fa236a798092c7db676929abff830e40f52ce8f3b3bdd8d4c2553d7c021fceaf120

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads