4abb19429ed0d1674b91a233c71d192290b185232a09115ae578fe25ac6f6835 | Triage

Analysis

max time kernel
20s
max time network
111s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12-07-2022 12:19

Sharing

Report Analysis Logs

General

Target

4abb19429ed0d1674b91a233c71d192290b185232a09115ae578fe25ac6f6835.exe
Size

1.2MB
MD5

a63f28714961ac6bdde57f8c4921dd01
SHA1

2ae8a9fb695025aaa4df0d74ecad45933f8653ba
SHA256

4abb19429ed0d1674b91a233c71d192290b185232a09115ae578fe25ac6f6835
SHA512

8ba38dfa6cd16ed0e8f47c1f964c729be49b32acec468a7c7366eb68a3a7bbc50c82d5c3a37233e0cccaca9ace9d62a9890f75ac910f946094a5e2d54ff2367d

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

4abb19429ed0d1674b91a233c71d192290b185232a09115ae578fe25ac6f6835.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\oreans32.sys 4abb19429ed0d1674b91a233c71d192290b185232a09115ae578fe25ac6f6835.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "82"	LogonUI.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

668
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4abb19429ed0d1674b91a233c71d192290b185232a09115ae578fe25ac6f6835.exe

description pid process

Token: SeShutdownPrivilege 4052 4abb19429ed0d1674b91a233c71d192290b185232a09115ae578fe25ac6f6835.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

3032 LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\4abb19429ed0d1674b91a233c71d192290b185232a09115ae578fe25ac6f6835.exe
"C:\Users\Admin\AppData\Local\Temp\4abb19429ed0d1674b91a233c71d192290b185232a09115ae578fe25ac6f6835.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c0855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...