Analysis
-
max time kernel
155s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-06-2022 06:02
Static task
static1
Behavioral task
behavioral1
Sample
2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe
Resource
win10v2004-20220414-en
General
-
Target
2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe
-
Size
636KB
-
MD5
fcec8baab829067eb68ffda01b9a2282
-
SHA1
85fcb5dd3af5c8544e282e1e4c7f1be21b4ca923
-
SHA256
2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317
-
SHA512
e5c03bc694ecb0f5a3d4c85bed91d44d9827687c0fa089b6c38190cd2711ecf286f40ad9594d4236d2af9052a839d92b53dd27d0eb91267247bdf6ac0585334b
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\hotfix.exe" 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe -
Processes:
resource yara_rule behavioral2/memory/736-130-0x0000000000400000-0x000000000074C000-memory.dmp upx behavioral2/memory/736-131-0x0000000000400000-0x000000000074C000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exepid process 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
Processes:
2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exepid process 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exepid process 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exepid process 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exedescription pid process target process PID 736 wrote to memory of 3348 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe cmd.exe PID 736 wrote to memory of 3348 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe cmd.exe PID 736 wrote to memory of 3348 736 2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe"C:\Users\Admin\AppData\Local\Temp\2a5a44a913821eef66b7f600445e1790bae0cbff312e9c2cf4fe19730cc1b317.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\hgksfg.bat2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\hgksfg.batFilesize
255B
MD577059c8e2c20b2ae76e98c597d35e92d
SHA17a51f853d3e5b934ab477f65ca7371f4835e8ef2
SHA256d738ec667f5d508c237828bf051a3fba012fe51ea62b38652fc056358f9e35b3
SHA512ad23344bef087cd6f654e891521898ba033d5db215ee1fc11035c9249831bedc8722200a6aa225f8b27e5a1fd9c3ed216064d7d9b764a1cc18926b5cc4a75dce
-
memory/736-130-0x0000000000400000-0x000000000074C000-memory.dmpFilesize
3.3MB
-
memory/736-131-0x0000000000400000-0x000000000074C000-memory.dmpFilesize
3.3MB
-
memory/3348-132-0x0000000000000000-mapping.dmp