Analysis
- max time kernel
153s - max time network
75s - platform
windows10-2004_x64 - resource
win10v2004-20220331-en - submitted
02/04/2022, 01:38
Static task
static1
Behavioral task
behavioral1
Sample
37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe
Resource
win10v2004-20220331-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe
- Size 1.4MB
- Sample220402-b2dbpaadb8
- SHA256 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce
- MD5 328f99aa9db2a9528ba5d78a68b03248
- SHA1 2d1bfb930067fa3448c28ac5dc59dfd4e59914b5
- SHA512 db3fa14b634ab75c0d95168c2d62532b93a998818450da16940fb6a513427e848cadc6235f0852e3da26e708389ef99ef9b7b179de22447f41c7098e55fda850
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe," 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe - Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\pathx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe" 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntos.exe 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe File created C:\Windows\SysWOW64\ntos.exe 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3 PID 988 wrote to memory of 584 988 37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe 3
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe"C:\Users\Admin\AppData\Local\Temp\37ffdcda2e7e7e0f389377dbb931108bafe07bd3c455f0dcd4fca15284121bce.exe"1⤵
- Modifies WinLogon for persistence
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:988