8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-03-2024 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
Size

431KB
MD5

9d0470ba47f6d3f61072317f6904d434
SHA1

aac8a0e4bbb48c34e02587f68c7e447d40d8052f
SHA256

8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca
SHA512

091cb8c16805d2c47960baa1c3a8ac599cdec7333b0022f139a101ca6edde96ceafef8e85155d17eb9c13fd632998a58c055f576f342d701432fe95bd5cb9617
SSDEEP

6144:A3MbvBaO9o7nduQyxg3XdECeSf3pAvTd5GPtRQrY1STCJxLhsLpoq5ynENQpjBei:OMbz9obd8uXxGLd3rYo2Jdhs/qVpjBei

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DC++ Share\setup.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\java.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\sIRC4.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\TabTip.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\DVDMaker.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\iexplore.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javaws.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrmstp.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\master_prefere.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\ShapeCollector.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jar.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java-rmi.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\javap.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\javaws.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javac.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\javadoc.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\javah.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\InkWatson.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\ielowutil.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\apt.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\java.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\jarsigner.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\javac.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7z.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\mip.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\MSOXMLED.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\OSPPSVC.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\setup.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\extcheck.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\ConvertInkStore.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\xdccPrograms\FlickLearningWizard.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\msinfo32.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\idlj.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javafxpackager.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\elevation_service.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\appletviewer.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javaw.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\xdccPrograms\7zFM.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\VSTOInstaller.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\idlj.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\jabswitch.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\DC++ Share\javap.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\xdccPrograms\Uninstall.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\xdccPrograms\InputPersonalization.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\chrome_pwa_launcher.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\notification_helper.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\iediagcmd.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\DC++ Share\ieinstal.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File created	C:\Windows\SysWOW64\sIRC4.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
File opened for modification	C:\Windows\SysWOW64\xdccPrograms\7z.exe	8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe

C:\Users\Admin\AppData\Local\Temp\8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe
"C:\Users\Admin\AppData\Local\Temp\8ba2dd78050386b227deb81f43b0b2b16eef33605937ff8ed6be08004fa5f7ca.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\xdccPrograms\7zFM.exe

Filesize
125KB

MD5
db73b7de2056ebe0d770ff2fd70a030e

SHA1
f72052dd45474bb4c9ae0787ecc410935e1e0ac9

SHA256
5ef2fbe2b7134ec67fb2bdbc203c315bf24b874d4c97bdba07c7290115275bf9

SHA512
9586d48f6b4eb38f0d8a7a3c6f18beeb08a00ffdb2a0dcfcef2416035b53386ebf5d711407ffa5b119de19d2f38082eb1644acb102e7b86aef2057fbcb3467d7

Download Submit
memory/2936-82-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2936-83-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2936-89-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads