4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11

General

Target

4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe
Size

244KB
MD5

7d434879979c5529a7b7a6a75c6400ed
SHA1

ed7bbc47344172a2e77c51c34370d6bcadeccd29
SHA256

4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11
SHA512

dae4a04b8b75d68faeca0ae0c6afa50c8ee97c09a1001073b105f2cb1ad5ad32e8fbc3488817d9024b52bf826f033bc709043d88a7b96b896903d25aa01226ef
SSDEEP

6144:eEXlSylvFuWaS54hIAv/QhuA7HY8pPZ0FP6BzxM5EmX:TAylvv5YRwh9HYd61xhmX

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2392	svchost.exe

Loads dropped DLL 7 IoCs

pid	Process
2764	4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe
2764	4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe
2564	WerFault.exe
2564	WerFault.exe
2564	WerFault.exe
2564	WerFault.exe
2564	WerFault.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\542bdc6f = "C:\\Windows\\apppatch\\svchost.exe"	4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\542bdc6f = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2564	2392	WerFault.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2392	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2764	4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2392	2764	4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe	30
PID 2764 wrote to memory of 2392	2764	4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe	30
PID 2764 wrote to memory of 2392	2764	4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe	30
PID 2764 wrote to memory of 2392	2764	4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe	30
PID 2392 wrote to memory of 2564	2392	svchost.exe	31
PID 2392 wrote to memory of 2564	2392	svchost.exe	31
PID 2392 wrote to memory of 2564	2392	svchost.exe	31
PID 2392 wrote to memory of 2564	2392	svchost.exe	31

C:\Users\Admin\AppData\Local\Temp\4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe
"C:\Users\Admin\AppData\Local\Temp\4f5c352ece7e5c178814d6ba51a78dee093a8b77393286047a67530f942bdf11.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2392 -s 368
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AppPatch\svchost.exe

Filesize
244KB

MD5
8c171dc65e40200d7d895b7f895d4c6c

SHA1
026ac96a679fa6c8033ab463588ddbef37c7bfec

SHA256
22526a397eec51ae2618dfad9be1731d3375dd6c3c1a6b533ccc4df1dcc0fb6a

SHA512
7794cb8cdcd261a855585c739fca7d91b65eb0c5bb61db5d52847fc1327f6745b45b8967623c7d722a8b9cfd70a94a5da8cc64f76c2264f8d28f10ed5080fc47

Download Submit
memory/2392-21-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2392-32-0x0000000001DF0000-0x0000000001E48000-memory.dmp

Filesize
352KB

Download
memory/2392-30-0x0000000000390000-0x00000000003DA000-memory.dmp

Filesize
296KB

Download
memory/2392-36-0x0000000001DF0000-0x0000000001E48000-memory.dmp

Filesize
352KB

Download
memory/2392-19-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2392-22-0x0000000000390000-0x00000000003DA000-memory.dmp

Filesize
296KB

Download
memory/2392-20-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2392-35-0x0000000001DF0000-0x0000000001E48000-memory.dmp

Filesize
352KB

Download
memory/2392-24-0x0000000000390000-0x00000000003DA000-memory.dmp

Filesize
296KB

Download
memory/2392-28-0x0000000000390000-0x00000000003DA000-memory.dmp

Filesize
296KB

Download
memory/2392-26-0x0000000000390000-0x00000000003DA000-memory.dmp

Filesize
296KB

Download
memory/2392-31-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2764-17-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2764-16-0x00000000004E0000-0x0000000000548000-memory.dmp

Filesize
416KB

Download
memory/2764-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2764-2-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2764-1-0x00000000004E0000-0x0000000000548000-memory.dmp

Filesize
416KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads