Analysis
- max time kernel
152s - max time network
92s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
16/04/2022, 01:33
Static task
static1
Behavioral task
behavioral1
Sample
1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe
- Size 740KB
- Sample220416-byhr1aheb2
- SHA256 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea
- MD5 211eb382f985e75ad8b4b106bdba7b2d
- SHA1 8e8f6c8bfd5036a8dd9f7a44cabfe04b2f9cd769
- SHA512 a632c1d7d8148b8388956dd32b5f2bbc3840f0ef332db30ce667c8489ced15deba90ffc69883fc5bf6eb75db18597ee7f4e20641c38daefef7a6b572a36198b9
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe," 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntos.exe 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe File created C:\Windows\SysWOW64\ntos.exe 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3 PID 4680 wrote to memory of 624 4680 1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe 3
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe"C:\Users\Admin\AppData\Local\Temp\1c9045db2cd972d7b1abc4d6808fd9f0563473ec7a8c7bd2d1e57513d55d7aea.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680