151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639

General

Target

151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe
Size

346KB
MD5

fb9c21a9cc24889784f8f943dd558f70
SHA1

836f910db289475f0e1404bad3461c6bc1e3c3b7
SHA256

151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639
SHA512

ac2dbb3ef927d8ba6e13102c9c193156cd3e19b53d797ef009eb0ccdad74313cd76e0f4ece13096cc4d075962e1bdc6db4a1b90c10d4d09c520c1e018a2ef8e1
SSDEEP

6144:+CjwZuxYoa6PTe6VlWT8b9MM2MNuTDbNSRuW:EZuXPTPVle8KM2TlSR

Score

10^/10

persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\Videos\\xdwdMicrosoft SharePoint.exe"	151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Drops file in Windows directory 1 IoCs

Processes:

151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe

description	ioc	Process
File created	C:\Windows\xdwd.dll	151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exeschtasks.exe

pid	Process
2704	schtasks.exe
2936	schtasks.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe

description	pid	Process
Token: SeDebugPrivilege	2384	151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exeCMD.exeCMD.exe

description	pid	Process	procid_target
PID 2384 wrote to memory of 2784	2384	151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe	32
PID 2384 wrote to memory of 2784	2384	151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe	32
PID 2384 wrote to memory of 2784	2384	151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe	32
PID 2784 wrote to memory of 2936	2784	CMD.exe	34
PID 2784 wrote to memory of 2936	2784	CMD.exe	34
PID 2784 wrote to memory of 2936	2784	CMD.exe	34
PID 2384 wrote to memory of 2532	2384	151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe	35
PID 2384 wrote to memory of 2532	2384	151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe	35
PID 2384 wrote to memory of 2532	2384	151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe	35
PID 2532 wrote to memory of 2704	2532	CMD.exe	37
PID 2532 wrote to memory of 2704	2532	CMD.exe	37
PID 2532 wrote to memory of 2704	2532	CMD.exe	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe
"C:\Users\Admin\AppData\Local\Temp\151943288a689ed0ed49c715efd9df77c7e4c7f838e56bed0573de3b62a1f639N.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Azure DevOps" /tr "C:\Users\Admin\Videos\xdwdMicrosoft SharePoint.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Azure DevOps" /tr "C:\Users\Admin\Videos\xdwdMicrosoft SharePoint.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2936
- C:\Windows\system32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Autodesk Revit Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdMicrosoft Hyper-V.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Autodesk Revit Upgrade" /tr "C:\Users\Admin\AppData\Local\xdwdMicrosoft Hyper-V.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Event Triggered Execution

1

T1546

AppInit DLLs

1

T1546.010

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-0-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/2384-1-0x0000000000ED0000-0x0000000000F2C000-memory.dmp

Filesize
368KB

Download
memory/2384-2-0x000007FEF5573000-0x000007FEF5574000-memory.dmp

Filesize
4KB

Download
memory/2384-34-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download
memory/2384-113-0x000007FEF5570000-0x000007FEF5F5C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads