cd493fb59393a2242ffe71504e9e9a556f033de55181fe7ef929b1d92b78809a

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_0e3745fef714a939e33e0a31ec8a4900.exe
Size

92KB
MD5

0e3745fef714a939e33e0a31ec8a4900
SHA1

dd790ef73d9fbb495b53151b91d3a13dc0f4be73
SHA256

cd493fb59393a2242ffe71504e9e9a556f033de55181fe7ef929b1d92b78809a
SHA512

d2d73cec2cf391af916dcd4dc3bbc438dbe8db00790c31717e7a8e98269cd410f0efa5b7c39b35a517320adecf492d110a1492009b2b33adca6070317f1a912c
SSDEEP

1536:BZbEZlEImSvTBH5c6Uuo4veQo/QCAarYlvlHHOIi0iICssrPxOgjX:fqEkDc684veQ9UJI7OssrPxX

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\skype.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1972	VirusShare_0e3745fef714a939e33e0a31ec8a4900.exe
1720	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1972	VirusShare_0e3745fef714a939e33e0a31ec8a4900.exe
1972	VirusShare_0e3745fef714a939e33e0a31ec8a4900.exe

C:\Users\Admin\AppData\Local\Temp\VirusShare_0e3745fef714a939e33e0a31ec8a4900.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_0e3745fef714a939e33e0a31ec8a4900.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:1972

C:\Windows\syswow64\svchost.exe
"C:\Windows\syswow64\svchost.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-6-0x0000000077850000-0x00000000779F9000-memory.dmp

Filesize
1.7MB

Download
memory/1376-7-0x0000000002E50000-0x0000000002E57000-memory.dmp

Filesize
28KB

Download
memory/1376-11-0x0000000077850000-0x00000000779F9000-memory.dmp

Filesize
1.7MB

Download
memory/1972-0-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/1972-1-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1972-3-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1972-2-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1972-5-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads