59a610e1a5d445eed446facf5cb57ba77792583a70c4b1d4cb9f09dfe752dd63

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c61febcfcba5472d44faaee9c3ff6274.exe
Size 268KB
Sample240313-ryggyahb46
SHA256 59a610e1a5d445eed446facf5cb57ba77792583a70c4b1d4cb9f09dfe752dd63
MD5 c61febcfcba5472d44faaee9c3ff6274
SHA1 4903a04ea3b401608bd24af1c38ff9ecb5dd2471
SHA512 7cbd340cf95eb70853bb63c7dc40853c67d4baac9677a5fb1d2556cbc7ac076efe551959ca536574da9ed1d07da6af007f15175d071d54fae0d95e0c3ad66c1d
SSDEEP 6144:y2Zgin4kXSd1buZyCsRUeoEK3T0+c4CN0YvCLxUOFHhO2C:ywHQ1KZM6eo3T0B9al62
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lsass.exe"	c61febcfcba5472d44faaee9c3ff6274.exe

Adds policy Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c61febcfcba5472d44faaee9c3ff6274.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MSWUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lsass.exe"	c61febcfcba5472d44faaee9c3ff6274.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	c61febcfcba5472d44faaee9c3ff6274.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MSWUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lsass.exe"	c61febcfcba5472d44faaee9c3ff6274.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4472	netsh.exe

Executes dropped EXE 2 IoCs

pid	Process
2616	lsass.exe
5088	lsass.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lsass.exe"	c61febcfcba5472d44faaee9c3ff6274.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSWUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\lsass.exe"	c61febcfcba5472d44faaee9c3ff6274.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4912 set thread context of 4420	4912	c61febcfcba5472d44faaee9c3ff6274.exe	97
PID 2616 set thread context of 5088	2616	lsass.exe	103

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4420	c61febcfcba5472d44faaee9c3ff6274.exe
5088	lsass.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4912 wrote to memory of 4420	4912	c61febcfcba5472d44faaee9c3ff6274.exe	97
PID 4912 wrote to memory of 4420	4912	c61febcfcba5472d44faaee9c3ff6274.exe	97
PID 4912 wrote to memory of 4420	4912	c61febcfcba5472d44faaee9c3ff6274.exe	97
PID 4912 wrote to memory of 4420	4912	c61febcfcba5472d44faaee9c3ff6274.exe	97
PID 4912 wrote to memory of 4420	4912	c61febcfcba5472d44faaee9c3ff6274.exe	97
PID 4912 wrote to memory of 4420	4912	c61febcfcba5472d44faaee9c3ff6274.exe	97
PID 4912 wrote to memory of 4420	4912	c61febcfcba5472d44faaee9c3ff6274.exe	97
PID 4912 wrote to memory of 4420	4912	c61febcfcba5472d44faaee9c3ff6274.exe	97
PID 4420 wrote to memory of 4472	4420	c61febcfcba5472d44faaee9c3ff6274.exe	98
PID 4420 wrote to memory of 4472	4420	c61febcfcba5472d44faaee9c3ff6274.exe	98
PID 4420 wrote to memory of 4472	4420	c61febcfcba5472d44faaee9c3ff6274.exe	98
PID 4420 wrote to memory of 2616	4420	c61febcfcba5472d44faaee9c3ff6274.exe	100
PID 4420 wrote to memory of 2616	4420	c61febcfcba5472d44faaee9c3ff6274.exe	100
PID 4420 wrote to memory of 2616	4420	c61febcfcba5472d44faaee9c3ff6274.exe	100
PID 2616 wrote to memory of 5088	2616	lsass.exe	103
PID 2616 wrote to memory of 5088	2616	lsass.exe	103
PID 2616 wrote to memory of 5088	2616	lsass.exe	103
PID 2616 wrote to memory of 5088	2616	lsass.exe	103
PID 2616 wrote to memory of 5088	2616	lsass.exe	103
PID 2616 wrote to memory of 5088	2616	lsass.exe	103
PID 2616 wrote to memory of 5088	2616	lsass.exe	103
PID 2616 wrote to memory of 5088	2616	lsass.exe	103

C:\Users\Admin\AppData\Local\Temp\c61febcfcba5472d44faaee9c3ff6274.exe
"C:\Users\Admin\AppData\Local\Temp\c61febcfcba5472d44faaee9c3ff6274.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4912
- C:\Users\Admin\AppData\Local\Temp\c61febcfcba5472d44faaee9c3ff6274.exe
  C:\Users\Admin\AppData\Local\Temp\c61febcfcba5472d44faaee9c3ff6274.exe
  2⤵
  - Modifies WinLogon for persistence
  - Adds policy Run key to start application
  - Adds Run key to start application
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="ImgBurn" dir=in action=allow description="Multimedia suite" program="C:\Users\Admin\AppData\Roaming\Microsoft\lsass.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4472
- - C:\Users\Admin\AppData\Roaming\Microsoft\lsass.exe
    /k C:\Users\Admin\AppData\Local\Temp\c61febcfcba5472d44faaee9c3ff6274.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Users\Admin\AppData\Roaming\Microsoft\lsass.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\lsass.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4156 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

QcbvXkSFHDsBJ.tmp

Path C:\Users\Admin\AppData\Roaming\Microsoft\QcbvXkSFHDsBJ.tmp
Size 18KB
SHA256 b465036b723ca3a35874e6eb4a2560140a2a9364ecc53b2dc7c0f1b59d216bea
MD5 d86c179bcfbd66e883f47019ea1ca200
SHA1 c63ad8a4b2a4c3e5408225a1231e25ec44d65eb8
SHA512 d9136ce45ba1210a717199f6f9292a656ef0fa86674c168a9be09c7ae2aab25c247bc417d1bf24c11fc403becc0da50805a61f0731c358c596a0780ffe986d8f
SSDEEP 384:f2HVsIRfGJ6nVTJ6nVjJ6nVeJ6nVHJ6nV6J6nVQJ6nVlJ6nVSJ6nVEXiJO2rarl/:f2lGdrhiPhsbh
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsass.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\lsass.exe
Size 268KB
SHA256 59a610e1a5d445eed446facf5cb57ba77792583a70c4b1d4cb9f09dfe752dd63
MD5 c61febcfcba5472d44faaee9c3ff6274
SHA1 4903a04ea3b401608bd24af1c38ff9ecb5dd2471
SHA512 7cbd340cf95eb70853bb63c7dc40853c67d4baac9677a5fb1d2556cbc7ac076efe551959ca536574da9ed1d07da6af007f15175d071d54fae0d95e0c3ad66c1d
SSDEEP 6144:y2Zgin4kXSd1buZyCsRUeoEK3T0+c4CN0YvCLxUOFHhO2C:ywHQ1KZM6eo3T0B9al62
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4420-0-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4420-2-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/4420-10-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5088-15-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5088-34-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5088-37-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5088-39-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5088-42-0x0000000000400000-0x0000000000435000-memory.dmp

Download

memory/5088-45-0x0000000000400000-0x0000000000435000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads