2efaca7c89121bf68861283d15ba240a38b9b3e1531e1eb265e605371f7a72d2

Analysis

max time kernel
126s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Morton Glass Works PO.exe
Size

827KB
MD5

8720b06d6f6e4c139604d4a9878f04bb
SHA1

bd3d5e523e34d2501d3a5293ae6f14fb70eb61e9
SHA256

2efaca7c89121bf68861283d15ba240a38b9b3e1531e1eb265e605371f7a72d2
SHA512

e2a80f842dc00011644c6c1088bc9f9de9be6468f3dae6166e0c5a77e7d4610dc487b7cdc687337d79d4d9a4854329c8839832b5538d18badb456df987c6442d
SSDEEP

12288:K6OzGbNrJaYfumFKW3hFbKLEk20D82Yv8nnjNJvP1elfA+i6hDdDdumO6RCdO243:YzGhrJhuo3hZgE+8TCnH2fA6lcPCd

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Windows\\SysWOW64\\Morton Glass Works PO.exe,"	reg.exe

Executes dropped EXE 1 IoCs

pid	Process
1896	Morton Glass Works PO.exe

Loads dropped DLL 3 IoCs

pid	Process
2628	cmd.exe
1896	Morton Glass Works PO.exe
1896	Morton Glass Works PO.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Morton Glass Works PO.exe	cmd.exe
File created	C:\Windows\SysWOW64\Morton Glass Works PO.exe	cmd.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
2948	PING.EXE
2436	PING.EXE
1260	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1976	Morton Glass Works PO.exe
1976	Morton Glass Works PO.exe
1976	Morton Glass Works PO.exe
1976	Morton Glass Works PO.exe
1976	Morton Glass Works PO.exe
1976	Morton Glass Works PO.exe
1896	Morton Glass Works PO.exe
1896	Morton Glass Works PO.exe
1896	Morton Glass Works PO.exe
1896	Morton Glass Works PO.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1976	Morton Glass Works PO.exe
Token: SeDebugPrivilege	1896	Morton Glass Works PO.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2700	1976	Morton Glass Works PO.exe	28
PID 1976 wrote to memory of 2700	1976	Morton Glass Works PO.exe	28
PID 1976 wrote to memory of 2700	1976	Morton Glass Works PO.exe	28
PID 1976 wrote to memory of 2700	1976	Morton Glass Works PO.exe	28
PID 1976 wrote to memory of 2700	1976	Morton Glass Works PO.exe	28
PID 1976 wrote to memory of 2700	1976	Morton Glass Works PO.exe	28
PID 1976 wrote to memory of 2700	1976	Morton Glass Works PO.exe	28
PID 2700 wrote to memory of 2948	2700	cmd.exe	30
PID 2700 wrote to memory of 2948	2700	cmd.exe	30
PID 2700 wrote to memory of 2948	2700	cmd.exe	30
PID 2700 wrote to memory of 2948	2700	cmd.exe	30
PID 2700 wrote to memory of 2948	2700	cmd.exe	30
PID 2700 wrote to memory of 2948	2700	cmd.exe	30
PID 2700 wrote to memory of 2948	2700	cmd.exe	30
PID 1976 wrote to memory of 2628	1976	Morton Glass Works PO.exe	31
PID 1976 wrote to memory of 2628	1976	Morton Glass Works PO.exe	31
PID 1976 wrote to memory of 2628	1976	Morton Glass Works PO.exe	31
PID 1976 wrote to memory of 2628	1976	Morton Glass Works PO.exe	31
PID 1976 wrote to memory of 2628	1976	Morton Glass Works PO.exe	31
PID 1976 wrote to memory of 2628	1976	Morton Glass Works PO.exe	31
PID 1976 wrote to memory of 2628	1976	Morton Glass Works PO.exe	31
PID 2628 wrote to memory of 2436	2628	cmd.exe	33
PID 2628 wrote to memory of 2436	2628	cmd.exe	33
PID 2628 wrote to memory of 2436	2628	cmd.exe	33
PID 2628 wrote to memory of 2436	2628	cmd.exe	33
PID 2628 wrote to memory of 2436	2628	cmd.exe	33
PID 2628 wrote to memory of 2436	2628	cmd.exe	33
PID 2628 wrote to memory of 2436	2628	cmd.exe	33
PID 2700 wrote to memory of 2412	2700	cmd.exe	34
PID 2700 wrote to memory of 2412	2700	cmd.exe	34
PID 2700 wrote to memory of 2412	2700	cmd.exe	34
PID 2700 wrote to memory of 2412	2700	cmd.exe	34
PID 2700 wrote to memory of 2412	2700	cmd.exe	34
PID 2700 wrote to memory of 2412	2700	cmd.exe	34
PID 2700 wrote to memory of 2412	2700	cmd.exe	34
PID 2628 wrote to memory of 1260	2628	cmd.exe	37
PID 2628 wrote to memory of 1260	2628	cmd.exe	37
PID 2628 wrote to memory of 1260	2628	cmd.exe	37
PID 2628 wrote to memory of 1260	2628	cmd.exe	37
PID 2628 wrote to memory of 1260	2628	cmd.exe	37
PID 2628 wrote to memory of 1260	2628	cmd.exe	37
PID 2628 wrote to memory of 1260	2628	cmd.exe	37
PID 2628 wrote to memory of 1896	2628	cmd.exe	38
PID 2628 wrote to memory of 1896	2628	cmd.exe	38
PID 2628 wrote to memory of 1896	2628	cmd.exe	38
PID 2628 wrote to memory of 1896	2628	cmd.exe	38
PID 2628 wrote to memory of 1896	2628	cmd.exe	38
PID 2628 wrote to memory of 1896	2628	cmd.exe	38
PID 2628 wrote to memory of 1896	2628	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\Morton Glass Works PO.exe
"C:\Users\Admin\AppData\Local\Temp\Morton Glass Works PO.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 38 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Windows\SysWOW64\Morton Glass Works PO.exe,"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 38
    3⤵
    - Runs ping.exe
    PID:2948
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Windows\SysWOW64\Morton Glass Works PO.exe,"
    3⤵
    - Modifies WinLogon for persistence
    PID:2412
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c ping 127.0.0.1 -n 47 > nul && copy "C:\Users\Admin\AppData\Local\Temp\Morton Glass Works PO.exe" "C:\Windows\SysWOW64\Morton Glass Works PO.exe" && ping 127.0.0.1 -n 47 > nul && "C:\Windows\SysWOW64\Morton Glass Works PO.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 47
    3⤵
    - Runs ping.exe
    PID:2436
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 47
    3⤵
    - Runs ping.exe
    PID:1260
- - C:\Windows\SysWOW64\Morton Glass Works PO.exe
    "C:\Windows\SysWOW64\Morton Glass Works PO.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\Morton Glass Works PO.exe

Filesize
827KB

MD5
8720b06d6f6e4c139604d4a9878f04bb

SHA1
bd3d5e523e34d2501d3a5293ae6f14fb70eb61e9

SHA256
2efaca7c89121bf68861283d15ba240a38b9b3e1531e1eb265e605371f7a72d2

SHA512
e2a80f842dc00011644c6c1088bc9f9de9be6468f3dae6166e0c5a77e7d4610dc487b7cdc687337d79d4d9a4854329c8839832b5538d18badb456df987c6442d

Download Submit
memory/1896-11-0x0000000000A40000-0x0000000000B10000-memory.dmp

Filesize
832KB

Download
memory/1976-0-0x0000000000B10000-0x0000000000BE0000-memory.dmp

Filesize
832KB

Download
memory/1976-1-0x0000000000550000-0x0000000000594000-memory.dmp

Filesize
272KB

Download