Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-11-2022 06:59
Static task
static1
Behavioral task
behavioral1
Sample
ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe
Resource
win7-20220901-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe
-
Size
250KB
-
MD5
3b1c507c0d0cd3a9d57ff6df2eec8440
-
SHA1
d29ff8bd5182a1f9f493205ff8add0d789a982a9
-
SHA256
ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873
-
SHA512
c36463da0069c9ef710ce69e85f805c6d3973635c6202494a9f8262327598332c9fcc1b7b377f43de02e6b69b1502c880927e435cd56504605f228cb5705f514
-
SSDEEP
6144:7cjlsubtn6BV+/1PSSggDhBkLq2pjMoyYKRKESBv:AiuZ6Bq1aMWqBTSV
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\ECC083~1.EXE," ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ECC083~1.EXE" ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\2c76f4da = "•'âŸ}/¸)Z\x1f®gLÀ\x0eײ.:G1'ž²\r\t\ai‘N\x1fßz²TI-ò\ri~°P#ÛÁ%\x13.\x17'ü\x1fÉ[„\v‰L\x13\x18^¨‘Ò=zÛ\u0090V\u0081Á6ÓôáÜ«\a\\Üæ\x04cqš\u00a05„jRÜîâ‚6ŽiüÏ•\u008fª\"¶º\x16íRuñº\x1aõ\u00adú¢\nÊí-rB‚r:F¢âz¾‚Í‚\nB&î\x06úµò}\x06š\x1d±Z\"žš5\x162êºr\x02jN¦Ú‚fÒúþ^…Ùåýõ¢¥\x1eb\x155¦rÉr~…Ñ:\x06úÉZõ‚â½J\x06\x02º\n*B\"Q)†\"â\x1dºµ2ªJÖ±á¥ò¢\t¢ò\x1aÊ¢–=ª2¡*J‚\u00ad\x12-‘]N™%:\x1dé\"%š\x01\tJâu–\x02‚" ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ECC083~1.EXE" ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe Token: SeSecurityPrivilege 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe Token: SeSecurityPrivilege 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe Token: SeSecurityPrivilege 3684 ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe"C:\Users\Admin\AppData\Local\Temp\ecc0838f5aa479ce6ba861e7ba5db38806a3743e941a5ff3aac8b010410d0873.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684