485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20-09-2024 19:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822.exe
Size

152KB
MD5

6eb51e667f293c61e48b88a2a9dafed3
SHA1

307febd5cf51fe0bcf75f48690c1d827dbbcca3c
SHA256

485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822
SHA512

7eb299e5377df85b4cb6ade9671a2abfc287e7dd2f13877a14358202299b9dfac168fade8e3bb0bbe3785d99e2c723e9a99c48870c046ed942c9009052eb49e1
SSDEEP

3072:Kru5SkB2ca09lIqb5nr5JYpQ4O8k99K//RLbyVZtde:uoSkB2R09l9b5ntD4LKS/6de

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1728	svchost.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\e0893f97 = "C:\\Windows\\apppatch\\svchost.exe"	485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\e0893f97 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\apppatch\svchost.exe	485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822.exe
File created	C:\Windows\apppatch\svchost.exe	485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1728	svchost.exe
1728	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3728	485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3728 wrote to memory of 1728	3728	485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822.exe	82
PID 3728 wrote to memory of 1728	3728	485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822.exe	82
PID 3728 wrote to memory of 1728	3728	485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822.exe	82

C:\Users\Admin\AppData\Local\Temp\485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822.exe
"C:\Users\Admin\AppData\Local\Temp\485455e79fea2c774fbfcb0a74cbb51b7fa242a3f4a1541143acdee88b98b822.exe"
1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3728
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\apppatch\svchost.exe

Filesize
152KB

MD5
b7d1d8c7b09d4132cb41ebb1e266c9e8

SHA1
5ab55c8e0f64fb73a0f364bc96b15b5ba0293a07

SHA256
e1ad0c0ca715780dd5a0855a441e578d01527cca264809da64ac9917e9c04df8

SHA512
24bec4fb2d50d89dd1573ef841231c88ca92afd950a5f80fc03c6d304627e4e5c82a870c3f454707a4f2d690e16f2b0d3b41b461f321b1a8a625cd6ee1b5fe9c

Download Submit
memory/1728-17-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1728-14-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1728-15-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/1728-16-0x0000000002960000-0x00000000029A6000-memory.dmp

Filesize
280KB

Download
memory/1728-18-0x0000000002AF0000-0x0000000002B3A000-memory.dmp

Filesize
296KB

Download
memory/1728-20-0x0000000002AF0000-0x0000000002B3A000-memory.dmp

Filesize
296KB

Download
memory/1728-22-0x0000000002AF0000-0x0000000002B3A000-memory.dmp

Filesize
296KB

Download
memory/1728-25-0x0000000002AF0000-0x0000000002B3A000-memory.dmp

Filesize
296KB

Download
memory/3728-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3728-10-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3728-13-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3728-12-0x00000000021B0000-0x00000000021E9000-memory.dmp

Filesize
228KB

Download
memory/3728-0-0x00000000021B0000-0x00000000021E9000-memory.dmp

Filesize
228KB

Download