0858c3f707ce06636879d2b349cdf8746673fa98117a2b04ded2b0297ae31c29

Analysis

max time kernel
103s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 11:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c90f2a37bd610f7991b6e387de829040N.exe
Size 248KB
Sample240825-nx4passfmf
SHA256 0858c3f707ce06636879d2b349cdf8746673fa98117a2b04ded2b0297ae31c29
MD5 c90f2a37bd610f7991b6e387de829040
SHA1 77bc4bbe4c08bbe8969fc7d214ba473304bb39e1
SHA512 41bc02d0b1a321a4334ea88930d985ba761afd88dbff541d5f4ecd966b3c9e2dcae15db2e4cfa1548ab6e7b0fe232238dd5ba8575871903252acb5a4bcab04c9
SSDEEP 6144:gk1eNshhrZahVbNzD3kXVqpV+x9YpY9Fq4f5jgGx5:gk9ZahVm0pseoxjB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
5012	svchost.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\c794c61b = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\c794c61b = "C:\\Windows\\apppatch\\svchost.exe"	c90f2a37bd610f7991b6e387de829040N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	c90f2a37bd610f7991b6e387de829040N.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	c90f2a37bd610f7991b6e387de829040N.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3700	5012	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c90f2a37bd610f7991b6e387de829040N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5012	svchost.exe
5012	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2280	c90f2a37bd610f7991b6e387de829040N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 5012	2280	c90f2a37bd610f7991b6e387de829040N.exe	84
PID 2280 wrote to memory of 5012	2280	c90f2a37bd610f7991b6e387de829040N.exe	84
PID 2280 wrote to memory of 5012	2280	c90f2a37bd610f7991b6e387de829040N.exe	84

C:\Users\Admin\AppData\Local\Temp\c90f2a37bd610f7991b6e387de829040N.exe
"C:\Users\Admin\AppData\Local\Temp\c90f2a37bd610f7991b6e387de829040N.exe"
1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5012 -s 828
    3⤵
    - Program crash
    PID:3700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5012 -ip 5012
1⤵
PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svchost.exe

Path C:\Windows\apppatch\svchost.exe
Size 248KB
SHA256 b945e2db41f71d94767f417ce761b866821a25e38f15a274200f72319dd5be27
MD5 80a751f8f6beb944f14fb827767e30e7
SHA1 5062e7f7dfd52941b8b39c8f6db40de4a5732705
SHA512 ae651ab2721e805639a2c804b8b97d8d6fa32cc613d750e28a8d7792315cb645b32c8ed8ef3424eb42b2babcb39987d3adb5106f9ca41a0010f294b2b5263a22
SSDEEP 6144:tk1eNshhrZahVbNzD3kXVqpV+x9YpY9Fq4f5jgGx5:tk9ZahVm0pseoxjB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2280-0-0x00000000021D0000-0x0000000002238000-memory.dmp

Download

memory/2280-1-0x0000000000400000-0x0000000000469000-memory.dmp

Download

memory/2280-11-0x0000000000400000-0x0000000000469000-memory.dmp

Download

memory/2280-12-0x00000000021D0000-0x0000000002238000-memory.dmp

Download

memory/5012-13-0x0000000000400000-0x0000000000469000-memory.dmp

Download

memory/5012-14-0x00000000029B0000-0x00000000029FA000-memory.dmp

Download

memory/5012-15-0x0000000000400000-0x0000000000469000-memory.dmp

Download

memory/5012-16-0x0000000002B40000-0x0000000002B98000-memory.dmp

Download

memory/5012-18-0x0000000002B40000-0x0000000002B98000-memory.dmp

Download

memory/5012-20-0x0000000002B40000-0x0000000002B98000-memory.dmp

Download

memory/5012-23-0x0000000002B40000-0x0000000002B98000-memory.dmp

Download