d59673c999f3f442f8e3408400e963f96c0ff441b9478e90a86026de41a9e487

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8c1fa7b9f8818580e6531103672dade.exe
Size

152KB
MD5

b8c1fa7b9f8818580e6531103672dade
SHA1

83e19142d500dca959dfd159c33ee857df953fe5
SHA256

d59673c999f3f442f8e3408400e963f96c0ff441b9478e90a86026de41a9e487
SHA512

b3b05f1cdc44c84416a122bbde77c1de5b4e3d41a71d3883c10fcf851edd3a33c755ec9f648930ee953192f1581f4c55f3e1127ccdd404596f0529b8316e7369
SSDEEP

3072:UpNlV8gSvbLlf+U704ChxTQqh7/28guGE0ocENjMdr:UpNlVIlGd4CFh7/28gUQ

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\dllcache\\zreportbugs.exe,"	b8c1fa7b9f8818580e6531103672dade.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	b8c1fa7b9f8818580e6531103672dade.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dllcache\zreportbugs.exe	b8c1fa7b9f8818580e6531103672dade.exe
File created	C:\Windows\SysWOW64\dllcache\zreportbugs.exe	b8c1fa7b9f8818580e6531103672dade.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3564	b8c1fa7b9f8818580e6531103672dade.exe
3564	b8c1fa7b9f8818580e6531103672dade.exe
3564	b8c1fa7b9f8818580e6531103672dade.exe
3564	b8c1fa7b9f8818580e6531103672dade.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3564	b8c1fa7b9f8818580e6531103672dade.exe
3564	b8c1fa7b9f8818580e6531103672dade.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 5096	3564	b8c1fa7b9f8818580e6531103672dade.exe	97
PID 3564 wrote to memory of 5096	3564	b8c1fa7b9f8818580e6531103672dade.exe	97
PID 3564 wrote to memory of 5096	3564	b8c1fa7b9f8818580e6531103672dade.exe	97
PID 5096 wrote to memory of 3032	5096	cmd.exe	99
PID 5096 wrote to memory of 3032	5096	cmd.exe	99
PID 5096 wrote to memory of 3032	5096	cmd.exe	99

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3032	attrib.exe

C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe
"C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\SysWOW64\attrib.exe
    attrib -a -r -s -h " C:\Users\Admin\AppData\Local\Temp\b8c1fa7b9f8818580e6531103672dade.exe"
    3⤵
    - Views/modifies file attributes
    PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1344 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\del.bat

Filesize
289B

MD5
34f9df4592140de286f3d5a50ce349a8

SHA1
79be6a924c55608bbaee413b89a30a01be1debd5

SHA256
4a616ee615eabfb9d2ff931fb94c921b4bbd07a52316ea13500f5a6aeb60725d

SHA512
710898c052418788ead94cf55ef4e1fed41ebc4c4ba2fce5a1d2167db9d431d9cc612e9667921c61ab1fd3f47b8296e9857f05677444c02e7845b25820698e57

Download Submit