Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 21:45
Static task
static1
Behavioral task
behavioral1
Sample
53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe
Resource
win10v2004-20240426-en
General
-
Target
53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe
-
Size
157KB
-
MD5
f065a49b98006266d3c011477b78c8d5
-
SHA1
aec187b78c78a8ca73aa0e169fa1f15b6587c0aa
-
SHA256
53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424
-
SHA512
8f6bb966fb2104ea2c59d678a6f83fb5553e335f18232413aec97d6cfbae3fbbc7335aac5f9e3a63bba9c4b7560362f91dca8d48f69014fa9622313dc37a32b0
-
SSDEEP
3072:YeojyYsAq/C3RCzgJHvNA1PpYfFL6zU+BEfi:7ojjqahUSPe1SZ+h
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 3004 svchost.exe -
Loads dropped DLL 2 IoCs
Processes:
53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exepid process 3008 53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe 3008 53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exesvchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\57a6c0e7 = "C:\\Windows\\apppatch\\svchost.exe" 53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\57a6c0e7 = "C:\\Windows\\apppatch\\svchost.exe" svchost.exe -
Drops file in Windows directory 2 IoCs
Processes:
53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exedescription ioc process File created C:\Windows\apppatch\svchost.exe 53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe File opened for modification C:\Windows\apppatch\svchost.exe 53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe 3004 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exepid process 3008 53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exedescription pid process target process PID 3008 wrote to memory of 3004 3008 53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe svchost.exe PID 3008 wrote to memory of 3004 3008 53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe svchost.exe PID 3008 wrote to memory of 3004 3008 53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe svchost.exe PID 3008 wrote to memory of 3004 3008 53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe"C:\Users\Admin\AppData\Local\Temp\53f95d374ced8be3217420dd197256d37132f38512bfdd15898faea2a7c85424.exe"1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\AppPatch\svchost.exeFilesize
157KB
MD5b548289b5b03072ef8a430da4374291b
SHA1370bb4a7e7a204fcd5b51f321e743ba439d539a5
SHA256479ea5b6d103e3269ff89205e543af9b0c07c1b8e286d68f52a215edd0b57e5a
SHA5122c08b8d24c390300a0884453816e6d0a9c48f66acfc9edf8cbd3056c82fbc646bd067c015b3293eeaa01bb63b7d6d409664d914fa95937933aa4f8693c800df6
-
memory/3004-14-0x0000000000420000-0x0000000000466000-memory.dmpFilesize
280KB
-
memory/3004-24-0x0000000000420000-0x0000000000466000-memory.dmpFilesize
280KB
-
memory/3004-22-0x0000000000420000-0x0000000000466000-memory.dmpFilesize
280KB
-
memory/3004-20-0x0000000000420000-0x0000000000466000-memory.dmpFilesize
280KB
-
memory/3004-18-0x0000000000420000-0x0000000000466000-memory.dmpFilesize
280KB
-
memory/3004-16-0x0000000000420000-0x0000000000466000-memory.dmpFilesize
280KB
-
memory/3004-25-0x00000000004B0000-0x00000000004FA000-memory.dmpFilesize
296KB
-
memory/3004-27-0x00000000004B0000-0x00000000004FA000-memory.dmpFilesize
296KB
-
memory/3004-29-0x00000000004B0000-0x00000000004FA000-memory.dmpFilesize
296KB
-
memory/3004-33-0x00000000004B0000-0x00000000004FA000-memory.dmpFilesize
296KB
-
memory/3008-13-0x0000000000D70000-0x0000000000DA0000-memory.dmpFilesize
192KB