bb685539c59d667f34b30fdccbe2a6eb78486a530383e6edf940a4b6b7a82bda

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_54dfc29fc42caf6af1c5f30a55238a70.exe
Size

100KB
MD5

54dfc29fc42caf6af1c5f30a55238a70
SHA1

3513059c7ccfea44d205fb7bf1a77f8b597eee92
SHA256

bb685539c59d667f34b30fdccbe2a6eb78486a530383e6edf940a4b6b7a82bda
SHA512

88449c57cc26049f073ba571264c025285d7ff0d8bc8c0b9a9e6e01be1daa086fbe71e176ddd6830f72d05f84b10fc5f4c3188b4f60b31fa0aa2ce1a279bfa81
SSDEEP

1536:fHC/S0Ax3IQumqpl9cy4veQzOtLKCDlDYPLv8gDEgRqlO:vlZ3azcy4veQzO9D2PomEgRY

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\skype.dat"	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
756	VirusShare_54dfc29fc42caf6af1c5f30a55238a70.exe
668	svchost.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
756	VirusShare_54dfc29fc42caf6af1c5f30a55238a70.exe
756	VirusShare_54dfc29fc42caf6af1c5f30a55238a70.exe

C:\Users\Admin\AppData\Local\Temp\VirusShare_54dfc29fc42caf6af1c5f30a55238a70.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_54dfc29fc42caf6af1c5f30a55238a70.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: MapViewOfSection
PID:756

C:\Windows\syswow64\svchost.exe
"C:\Windows\syswow64\svchost.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-0-0x0000000002910000-0x0000000002914000-memory.dmp

Filesize
16KB

Download
memory/756-1-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/756-3-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/756-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/756-4-0x0000000002920000-0x0000000002921000-memory.dmp

Filesize
4KB

Download
memory/756-5-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1380-7-0x0000000002A30000-0x0000000002A37000-memory.dmp

Filesize
28KB

Download
memory/1380-6-0x0000000077C70000-0x0000000077E19000-memory.dmp

Filesize
1.7MB

Download
memory/1380-11-0x0000000077C70000-0x0000000077E19000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads