d59673c999f3f442f8e3408400e963f96c0ff441b9478e90a86026de41a9e487

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8c1fa7b9f8818580e6531103672dade.exe
Size

152KB
MD5

b8c1fa7b9f8818580e6531103672dade
SHA1

83e19142d500dca959dfd159c33ee857df953fe5
SHA256

d59673c999f3f442f8e3408400e963f96c0ff441b9478e90a86026de41a9e487
SHA512

b3b05f1cdc44c84416a122bbde77c1de5b4e3d41a71d3883c10fcf851edd3a33c755ec9f648930ee953192f1581f4c55f3e1127ccdd404596f0529b8316e7369
SSDEEP

3072:UpNlV8gSvbLlf+U704ChxTQqh7/28guGE0ocENjMdr:UpNlVIlGd4CFh7/28gUQ

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\dllcache\\zreportbugs.exe,"	b8c1fa7b9f8818580e6531103672dade.exe

Deletes itself 1 IoCs

pid	Process
1272	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dllcache\zreportbugs.exe	b8c1fa7b9f8818580e6531103672dade.exe
File created	C:\Windows\SysWOW64\dllcache\zreportbugs.exe	b8c1fa7b9f8818580e6531103672dade.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1228	b8c1fa7b9f8818580e6531103672dade.exe
1228	b8c1fa7b9f8818580e6531103672dade.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1228	b8c1fa7b9f8818580e6531103672dade.exe
1228	b8c1fa7b9f8818580e6531103672dade.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1228 wrote to memory of 1272	1228	b8c1fa7b9f8818580e6531103672dade.exe	28
PID 1228 wrote to memory of 1272	1228	b8c1fa7b9f8818580e6531103672dade.exe	28
PID 1228 wrote to memory of 1272	1228	b8c1fa7b9f8818580e6531103672dade.exe	28
PID 1228 wrote to memory of 1272	1228	b8c1fa7b9f8818580e6531103672dade.exe	28
PID 1272 wrote to memory of 2772	1272	cmd.exe	30
PID 1272 wrote to memory of 2772	1272	cmd.exe	30
PID 1272 wrote to memory of 2772	1272	cmd.exe	30
PID 1272 wrote to memory of 2772	1272	cmd.exe	30

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2772	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe
"C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  - Deletes itself
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\SysWOW64\attrib.exe
    attrib -a -r -s -h " C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe"
    3⤵
    - Views/modifies file attributes
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
289B

MD5
34f9df4592140de286f3d5a50ce349a8

SHA1
79be6a924c55608bbaee413b89a30a01be1debd5

SHA256
4a616ee615eabfb9d2ff931fb94c921b4bbd07a52316ea13500f5a6aeb60725d

SHA512
710898c052418788ead94cf55ef4e1fed41ebc4c4ba2fce5a1d2167db9d431d9cc612e9667921c61ab1fd3f47b8296e9857f05677444c02e7845b25820698e57

Download Submit