cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d

Analysis

max time kernel
137s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2022 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
Size

1.1MB
MD5

34959373b12605d845f9aaa1b5e6a718
SHA1

dceaabf833dc200642ed945996aef20562d6c5fd
SHA256

cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d
SHA512

984a158d67eecb46526ff15680fda42154bfb974013861c7db5d190ae8ecb7769dc38fef0cb1b67f3a7cf8d0cb33c52f2e560afbca54319b21bbfded6daeb86c
SSDEEP

12288:lenxWYKa5A932NNHoOKGzSDBfy/18Qd1opGJpXWsyFLr7xC76N4bJVVv5LloUEoP:lenMnpquXGzgey5uNwFLr7gBVVvhz1

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\WINDOWS\\Config\\csrss.exe"	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\MSWINSCK.OCX	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\Config\csrss.exe	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
File created	C:\WINDOWS\Config\csrss.exe	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\ = "FileSync ThumbnailProvider"	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\LocalServer32	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\ProgramData\TEMP:58FB35AD	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
File opened for modification	C:\ProgramData\TEMP:58FB35AD	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3272	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
Token: SeIncBasePriorityPrivilege	3272	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3272	cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe

C:\Users\Admin\AppData\Local\Temp\cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
"C:\Users\Admin\AppData\Local\Temp\cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe"
1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3272-133-0x0000000002010000-0x00000000020A4000-memory.dmp

Filesize
592KB

Download
memory/3272-138-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/3272-139-0x0000000002011000-0x000000000207E000-memory.dmp

Filesize
436KB

Download
memory/3272-140-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/3272-141-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/3272-142-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download
memory/3272-143-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/3272-146-0x0000000000400000-0x0000000000542000-memory.dmp

Filesize
1.3MB

Download