eef08abbf217708e292e591bfd8b1a1a6fc70711eedc91c34df5ae0535582538

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d50ca3f81a9fbfbb862111f056c860b6.exe
Size

66KB
MD5

d50ca3f81a9fbfbb862111f056c860b6
SHA1

b568017732cd08114829e0bda1f7f715b3e70a4e
SHA256

eef08abbf217708e292e591bfd8b1a1a6fc70711eedc91c34df5ae0535582538
SHA512

e9394242a2f484a9be90e698f61a38a09283b629ed86c546422973932cf45a237a7d0323767c65510d8661e9791bc11710dd25cbc35672945e06948332f77c55
SSDEEP

1536:4+86eabcyDAEvVRNTpCnL59Q1YA2cYSm/H4686TMcwpZPG9P3vyuTLXk:DRbc+FvVRNTpCnvQ1YA2l/Ytg0yVyMk

Score

8^/10

persistence

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	inetinfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\inetinfo = "C:\\Windows\\inetinfo.exe"	inetinfo.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d50ca3f81a9fbfbb862111f056c860b6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ctfmon = "C:\\Windows\\ctfmon.exe"	d50ca3f81a9fbfbb862111f056c860b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\inetinfo = "C:\\Windows\\inetinfo.exe"	d50ca3f81a9fbfbb862111f056c860b6.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	inetinfo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ctfmon = "C:\\Windows\\ctfmon.exe"	inetinfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	d50ca3f81a9fbfbb862111f056c860b6.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogon.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ctfmon = "C:\\Windows\\ctfmon.exe"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\inetinfo = "C:\\Windows\\inetinfo.exe"	winlogon.exe

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\networks.exe	d50ca3f81a9fbfbb862111f056c860b6.exe
File created	C:\Windows\system32\drivers\etc\networks.exe	winlogon.exe
File opened for modification	C:\Windows\system32\drivers\etc\networks.exe	winlogon.exe
File created	C:\Windows\system32\drivers\etc\networks.exe	inetinfo.exe
File opened for modification	C:\Windows\system32\drivers\etc\networks.exe	inetinfo.exe
File created	C:\Windows\system32\drivers\etc\networks.exe	d50ca3f81a9fbfbb862111f056c860b6.exe

Executes dropped EXE 2 IoCs

pid	Process
3016	winlogon.exe
2716	inetinfo.exe

Loads dropped DLL 5 IoCs

pid	Process
3016	winlogon.exe
3016	winlogon.exe
3016	winlogon.exe
3016	winlogon.exe
2716	inetinfo.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxBSLoad = "C:\\Windows\\system32\\MaxBSLoad.exe"	inetinfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\networks = "C:\\Windows\\winlogon.exe"	inetinfo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxBSLoad = "C:\\Windows\\system32\\MaxBSLoad.exe"	d50ca3f81a9fbfbb862111f056c860b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\networks = "C:\\Windows\\winlogon.exe"	d50ca3f81a9fbfbb862111f056c860b6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxBSLoad = "C:\\Windows\\system32\\MaxBSLoad.exe"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\networks = "C:\\Windows\\winlogon.exe"	winlogon.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\AutoRun.inf	inetinfo.exe
File opened for modification	F:\AutoRun.inf	inetinfo.exe
File created	F:\AutoRun.inf	inetinfo.exe
File opened for modification	C:\AutoRun.inf	inetinfo.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MaxBSLoad.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\MaxBSLoad.exe	winlogon.exe
File created	C:\Windows\SysWOW64\MaxBSLoad.exe	inetinfo.exe
File opened for modification	C:\Windows\SysWOW64\MaxBSLoad.exe	inetinfo.exe
File opened for modification	C:\Windows\SysWOW64\MSWINSCK.OCX	d50ca3f81a9fbfbb862111f056c860b6.exe
File created	C:\Windows\SysWOW64\MaxBSLoad.exe	d50ca3f81a9fbfbb862111f056c860b6.exe
File opened for modification	C:\Windows\SysWOW64\MaxBSLoad.exe	d50ca3f81a9fbfbb862111f056c860b6.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\ctfmon.exe	inetinfo.exe
File opened for modification	C:\Windows\ctfmon.exe	inetinfo.exe
File opened for modification	C:\Windows\ctfmon.exe	d50ca3f81a9fbfbb862111f056c860b6.exe
File opened for modification	C:\Windows\inetinfo.exe	d50ca3f81a9fbfbb862111f056c860b6.exe
File opened for modification	C:\Windows\winlogon.exe	d50ca3f81a9fbfbb862111f056c860b6.exe
File opened for modification	C:\Windows\winlogon.exe	winlogon.exe
File created	C:\Windows\ctfmon.exe	winlogon.exe
File opened for modification	C:\Windows\inetinfo.exe	inetinfo.exe
File opened for modification	C:\Windows\winlogon.exe	inetinfo.exe
File created	C:\Windows\ctfmon.exe	d50ca3f81a9fbfbb862111f056c860b6.exe
File opened for modification	C:\Windows\ctfmon.exe	winlogon.exe
File created	C:\Windows\winlogon.exe	d50ca3f81a9fbfbb862111f056c860b6.exe
File created	C:\Windows\winlogon.exe	winlogon.exe
File created	C:\Windows\inetinfo.exe	inetinfo.exe
File created	C:\Windows\winlogon.exe	inetinfo.exe
File created	C:\Windows\inetinfo.exe	d50ca3f81a9fbfbb862111f056c860b6.exe
File created	C:\Windows\inetinfo.exe	winlogon.exe
File opened for modification	C:\Windows\inetinfo.exe	winlogon.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Programmable	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ = "Microsoft WinSock Control, version 6.0 (SP6)"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32\ThreadingModel = "Apartment"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CurVer\ = "MSWinsock.Winsock.1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID\ = "MSWinsock.Winsock.1"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\ = "Microsoft Winsock Control 6.0 (SP6)"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\ = "0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ = "DMSWinsockControlEvents"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID\ = "{248DD896-BB45-11CF-9ABC-0080C7E7B78D}"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\CLSID	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\CLSID	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1\ = "132497"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX, 1"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\drivers\\etc\\networks.exe %1"	d50ca3f81a9fbfbb862111f056c860b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\InprocServer32	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock.1\ = "Microsoft WinSock Control, version 6.0 (SP6)"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Windows\\SysWow64\\drivers\\etc\\networks.exe %1"	winlogon.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS\ = "2"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSWinsock.Winsock\ = "Microsoft WinSock Control, version 6.0 (SP6)"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\FLAGS	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\MSWINSCK.OCX"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\ = "{248DD890-BB45-11CF-9ABC-0080C7E7B78D}"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command	d50ca3f81a9fbfbb862111f056c860b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\MiscStatus\1	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD897-BB45-11CF-9ABC-0080C7E7B78D}\ = "Winsock General Property Page Object"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\TypeLib\Version = "1.0"	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\HELPDIR	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\ProgID	winlogon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}	winlogon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}\ = "IMSWinsockControl"	winlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3016	winlogon.exe
Token: SeDebugPrivilege	2716	inetinfo.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2044	d50ca3f81a9fbfbb862111f056c860b6.exe
3016	winlogon.exe
2716	inetinfo.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 3016	2044	d50ca3f81a9fbfbb862111f056c860b6.exe	28
PID 2044 wrote to memory of 3016	2044	d50ca3f81a9fbfbb862111f056c860b6.exe	28
PID 2044 wrote to memory of 3016	2044	d50ca3f81a9fbfbb862111f056c860b6.exe	28
PID 2044 wrote to memory of 3016	2044	d50ca3f81a9fbfbb862111f056c860b6.exe	28
PID 3016 wrote to memory of 2716	3016	winlogon.exe	29
PID 3016 wrote to memory of 2716	3016	winlogon.exe	29
PID 3016 wrote to memory of 2716	3016	winlogon.exe	29
PID 3016 wrote to memory of 2716	3016	winlogon.exe	29

C:\Users\Admin\AppData\Local\Temp\d50ca3f81a9fbfbb862111f056c860b6.exe
"C:\Users\Admin\AppData\Local\Temp\d50ca3f81a9fbfbb862111f056c860b6.exe"
1⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\winlogon.exe
  C:\Windows\winlogon.exe
  2⤵
  - Adds policy Run key to start application
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\inetinfo.exe
    C:\Windows\inetinfo.exe
    3⤵
    - Adds policy Run key to start application
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\AutoRun.inf

Filesize
163B

MD5
512fca0bdc88098ba32f8bcd61e22144

SHA1
afc73edaff64c79f732e89777a223d1a938b7f33

SHA256
6817f958d7b3aecae14703989d0bb2b0d01f28fe52e14949f26e16e67734f8c8

SHA512
da68aac20ce0800c07ebefae94aeff5905f15acca430427e79c09beb382b45c77a4f04db98a31d9b25ce3ccd331e2ba2e2cac79aed5f3f8a2c4c0b3cd9ecc273

Download Submit
C:\Windows\SysWOW64\MSWINSCK.OCX

Filesize
56KB

MD5
0d776b0eb7682112ce5a4b764c87d3b6

SHA1
30a5ca287f53fd56e64ca7f341e5ca855ef43d46

SHA256
24076713e10a3c5cfbe683cb1b0713e68ffa286dae4e6f89ee22c546a92be597

SHA512
55d9888c900f1f57eddb4c80371ca21990080a72e855e08d4dda62362022e2f02e95014e76aaad15e89af6f6bf89c2f8ff5e12e64f4fe328496f28b7aaf86508

Download Submit
C:\Windows\inetinfo.exe

Filesize
66KB

MD5
d50ca3f81a9fbfbb862111f056c860b6

SHA1
b568017732cd08114829e0bda1f7f715b3e70a4e

SHA256
eef08abbf217708e292e591bfd8b1a1a6fc70711eedc91c34df5ae0535582538

SHA512
e9394242a2f484a9be90e698f61a38a09283b629ed86c546422973932cf45a237a7d0323767c65510d8661e9791bc11710dd25cbc35672945e06948332f77c55

Download Submit
memory/2044-47-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2044-24-0x00000000002B0000-0x00000000002CE000-memory.dmp

Filesize
120KB

Download
memory/2044-26-0x00000000002B0000-0x00000000002CE000-memory.dmp

Filesize
120KB

Download
memory/2044-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2716-67-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2716-55-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/2716-90-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/2716-89-0x0000000022170000-0x000000002219D000-memory.dmp

Filesize
180KB

Download
memory/2716-53-0x0000000022170000-0x000000002219D000-memory.dmp

Filesize
180KB

Download
memory/2716-54-0x0000000022170000-0x000000002219D000-memory.dmp

Filesize
180KB

Download
memory/3016-40-0x0000000022170000-0x000000002219D000-memory.dmp

Filesize
180KB

Download
memory/3016-69-0x0000000022170000-0x000000002219D000-memory.dmp

Filesize
180KB

Download
memory/3016-41-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/3016-46-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/3016-66-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3016-38-0x0000000022170000-0x000000002219D000-memory.dmp

Filesize
180KB

Download
memory/3016-68-0x0000000022170000-0x000000002219D000-memory.dmp

Filesize
180KB

Download
memory/3016-49-0x0000000000390000-0x00000000003AE000-memory.dmp

Filesize
120KB

Download
memory/3016-70-0x0000000000300000-0x000000000030E000-memory.dmp

Filesize
56KB

Download
memory/3016-28-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3016-87-0x0000000000390000-0x00000000003AE000-memory.dmp

Filesize
120KB

Download
memory/3016-88-0x0000000000390000-0x00000000003AE000-memory.dmp

Filesize
120KB

Download
memory/3016-44-0x0000000022170000-0x000000002219D000-memory.dmp

Filesize
180KB

Download
memory/3016-42-0x0000000022170000-0x000000002219D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads