92568303c5f9880d3c36c8f1e25516f1d51809598394fcc3b39f3cf36afd03d5

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
04-03-2024 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

__TEMP/wtsapi32.dll
Size

114KB
MD5

86b0aaf254435d2373190c5722b434c0
SHA1

8e418cd6c8c3797cbd0368e5b68c215a452fcefb
SHA256

27fc518c588175bc19e4379b90eda0e071b847254ea0701f02f1ccd945ca280f
SHA512

0381fa560389f2add8c426e61e80e297e3cfa224733257dbe3c605a78e79725b48c6ddf639294064b550145d8aad0cb0c8c13d0b909a57ad85c9a8e2cc446ec6
SSDEEP

1536:QOVM6xTEQhLHyIgSBTjSEpECC0j3Vm2XJD3sWvd09dlnSyGsqENz:DVMAEQFPdTjhpPDj3VBRbM1ysqENz

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

Microsoft.SharePoint.NativeMessagingClient.exe

pid process

1636 Microsoft.SharePoint.NativeMessagingClient.exe

pid	process
1636	Microsoft.SharePoint.NativeMessagingClient.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft.SharePoint = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SharepointFiles\\Microsoft.SharePoint.NativeMessagingClient.exe"	rundll32.exe

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 5036 wrote to memory of 1636	5036	rundll32.exe	Microsoft.SharePoint.NativeMessagingClient.exe
PID 5036 wrote to memory of 1636	5036	rundll32.exe	Microsoft.SharePoint.NativeMessagingClient.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\__TEMP\wtsapi32.dll,#1
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5036

C:\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe
"C:\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe"
2⤵
- Executes dropped EXE
PID:1636

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\SharepointFiles\Microsoft.SharePoint.NativeMessagingClient.exe
Filesize
70KB

MD5
ef3179d498793bf4234f708d3be28633

SHA1
dd399ae46303343f9f0da189aee11c67bd868222

SHA256
b53f3c0cd32d7f20849850768da6431e5f876b7bfa61db0aa0700b02873393fa

SHA512
02aff154762d7e53e37754f878ce6aa3f4df5a1eb167e27f13d9762dced32bec892bfa3f3314e3c6dce5998f7d3c400d7d0314b9326eedcab72207c60b3d332e

Download Submit