17f2c1ea90f7a90d08c5a3de34dbd08973daed2b8eeda65e7dc68cdb933b683f

General

Target

503d212b6795b4af9bc63a38e29e1340N.exe
Size

349KB
MD5

503d212b6795b4af9bc63a38e29e1340
SHA1

42ab014e91de372cf47fe7129931490f17d242b4
SHA256

17f2c1ea90f7a90d08c5a3de34dbd08973daed2b8eeda65e7dc68cdb933b683f
SHA512

8eb9a1f3b4f8c9a4e8f44146e5e1eb8e7459cf1bf6f2e8d652e4225cf5d743c80ec23d5975f442631a5f65f15b8f1d729b9428b90f5771021e5496865571a88e
SSDEEP

6144:rVTQ+SiexKAK4y6UvcZSeNH49qQQOH+ym4LLIoTqHSMaxzL:xSiOK4yjNQOGzoTCSMG

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3028	svchost.exe

Loads dropped DLL 5 IoCs

pid	Process
2420	503d212b6795b4af9bc63a38e29e1340N.exe
2420	503d212b6795b4af9bc63a38e29e1340N.exe
2856	WerFault.exe
2856	WerFault.exe
2856	WerFault.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\64db99c = "C:\\Windows\\apppatch\\svchost.exe"	503d212b6795b4af9bc63a38e29e1340N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\64db99c = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\apppatch\svchost.exe	503d212b6795b4af9bc63a38e29e1340N.exe
File created	C:\Windows\apppatch\svchost.exe	503d212b6795b4af9bc63a38e29e1340N.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2856	3028	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	503d212b6795b4af9bc63a38e29e1340N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3028	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2420	503d212b6795b4af9bc63a38e29e1340N.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 3028	2420	503d212b6795b4af9bc63a38e29e1340N.exe	30
PID 2420 wrote to memory of 3028	2420	503d212b6795b4af9bc63a38e29e1340N.exe	30
PID 2420 wrote to memory of 3028	2420	503d212b6795b4af9bc63a38e29e1340N.exe	30
PID 2420 wrote to memory of 3028	2420	503d212b6795b4af9bc63a38e29e1340N.exe	30
PID 3028 wrote to memory of 2856	3028	svchost.exe	32
PID 3028 wrote to memory of 2856	3028	svchost.exe	32
PID 3028 wrote to memory of 2856	3028	svchost.exe	32
PID 3028 wrote to memory of 2856	3028	svchost.exe	32

C:\Users\Admin\AppData\Local\Temp\503d212b6795b4af9bc63a38e29e1340N.exe
"C:\Users\Admin\AppData\Local\Temp\503d212b6795b4af9bc63a38e29e1340N.exe"
1⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3028 -s 388
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Winlogon Helper DLL

2

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AppPatch\svchost.exe

Filesize
349KB

MD5
0f684b2346554f16f7fe2755342ddb73

SHA1
7ccad96ca79b6cec13c41b75bc7f8e90744662f2

SHA256
5bfc21b78e4ebd3f04ea40eca1a6153a055b921ddc86fbb30fcd4f8ac548041e

SHA512
fbdf0db34b45bd66e1ac2437d260c47688ce164349512981fcc385f44aa05f833e170c93973bfe84fb22c45652ad682b8d8aa933453ba2b3a00db718c1c29801

Download Submit
memory/2420-12-0x0000000000B10000-0x0000000000B79000-memory.dmp

Filesize
420KB

Download
memory/3028-23-0x0000000000360000-0x00000000003AA000-memory.dmp

Filesize
296KB

Download
memory/3028-20-0x0000000000360000-0x00000000003AA000-memory.dmp

Filesize
296KB

Download
memory/3028-18-0x0000000000360000-0x00000000003AA000-memory.dmp

Filesize
296KB

Download
memory/3028-14-0x0000000000360000-0x00000000003AA000-memory.dmp

Filesize
296KB

Download
memory/3028-16-0x0000000000360000-0x00000000003AA000-memory.dmp

Filesize
296KB

Download
memory/3028-26-0x0000000000470000-0x00000000004C8000-memory.dmp

Filesize
352KB

Download
memory/3028-29-0x0000000000470000-0x00000000004C8000-memory.dmp

Filesize
352KB

Download
memory/3028-27-0x0000000000470000-0x00000000004C8000-memory.dmp

Filesize
352KB

Download
memory/3028-36-0x0000000000470000-0x00000000004C8000-memory.dmp

Filesize
352KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads