3526c74a22a6a7ff285bddc4a055d22e443bd2d9ceb47aa7bc20240256084787

Analysis

max time kernel
1798s
max time network
1560s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
Size

165KB
MD5

e3566b5bad34be0acd68d975274f48f0
SHA1

b4a8116598f602486598ba4b4e41fa82fe41b763
SHA256

9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97
SHA512

ac8da074e8f6d5ed1d1f012d9cec9d38a17e3d28ae13527394f719ab045e3f92f9ad99978a982edd5377ec9102c747e00ad55011e7d47179af2c7188cf060d60
SSDEEP

3072:xJ60eHr2T1ds7Z2gcsRxAHxZbL4W9qZVLzbce2liSsU5t9rL+Au9TGLyPl:xJh42T1dMZ2gcok3lazbX2zJ+bxN9

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe"	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

Disables Task Manager via registry modification
evasion

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

description	pid	process	target process
PID 1300 set thread context of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

pid process

1300 9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

pid	process
1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

description	pid	process	target process
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
PID 1300 wrote to memory of 2368	1300	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe	9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe

C:\Users\Admin\AppData\Local\Temp\9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
"C:\Users\Admin\AppData\Local\Temp\9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300

C:\Users\Admin\AppData\Local\Temp\9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
C:\Users\Admin\AppData\Local\Temp\9c109b79dae8527b370cc0b91d5822f4a69b3acda284c361b310e18738ec5a97.exe
2⤵
- Modifies WinLogon for persistence
- Modifies WinLogon
PID:2368

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-2-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-4-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-3-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-5-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-6-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-7-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-8-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-9-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-10-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-11-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-12-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-14-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-15-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-16-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-17-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-18-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-19-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-20-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-21-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-22-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-23-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-25-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-26-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-27-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-28-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-29-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-30-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-31-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-32-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-33-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-49-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-52-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-58-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-59-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-60-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-61-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-62-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-63-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2368-66-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads