Analysis
-
max time kernel
68s -
max time network
65s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
01-08-2020 19:36
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe
-
Size
113KB
-
MD5
605fd6ecbb77d69c381f18a865002edb
-
SHA1
7d5f8df774d0c28f0165c30369037e2a3584aab6
-
SHA256
9bd190203a73b19bda71958ad24f3b7cfc2867e5ac6c607444c6e406fb3ab476
-
SHA512
bae1cb11245d6a5d3d254b72b043107b7e94ea873678a9c2d061125e38ad4f6d24dbffea5c3b15a6e51659a90f104139c9cb2e0863e58aaab45041af34e2598c
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-5181719\\enowpea40.exe" SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe -
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-5181719\\enowpea40.exe" SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\enowpea4 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-5181719\\enowpea40.exe" SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exeSecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exedescription pid process target process PID 500 wrote to memory of 628 500 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe PID 500 wrote to memory of 628 500 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe PID 500 wrote to memory of 628 500 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe PID 500 wrote to memory of 628 500 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe PID 500 wrote to memory of 628 500 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe PID 500 wrote to memory of 628 500 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe PID 500 wrote to memory of 628 500 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe PID 500 wrote to memory of 628 500 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe PID 628 wrote to memory of 3032 628 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe Explorer.EXE PID 628 wrote to memory of 3032 628 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe Explorer.EXE PID 628 wrote to memory of 3032 628 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exedescription pid process target process PID 500 set thread context of 628 500 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exepid process 628 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe 628 SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exedescription ioc process File created C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-5181719\Desktop.ini SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.HLLW.Autoruner1.38636.30902.31421.exe"3⤵
- Modifies WinLogon
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Drops desktop.ini file(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/628-0-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/628-1-0x0000000000401920-mapping.dmp
-
memory/628-2-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/628-3-0x00000000024C0000-0x00000000024C1000-memory.dmpFilesize
4KB
-
memory/628-4-0x0000000002CC0000-0x0000000002CC1000-memory.dmpFilesize
4KB