928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3

Analysis

max time kernel
14s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe
Size

253KB
MD5

60e0f60835d02027536ec7428ba4e1f1
SHA1

1e32a9c911cbfb039774e62d9280be0a8c67b8cf
SHA256

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3
SHA512

29ea1b8656d3d8ec4931f80ed82cbaf976497b436c0c759bffedfa3c0a281196a84b8dd0b654cb0d4c8224cdf2f9c84c05ff7d4525cd421977b06740576b1398
SSDEEP

6144:7ofmbENRmu5AVce2UJJbJFZvkO1zjxBtdMl8erwhFfmT:YFdScSHkO1rtd4rwhVmT

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,C:\\Windows\\system32\\ntos.exe,"	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

Drops file in System32 directory 2 IoCs

Processes:

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ntos.exe	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe
File created	C:\Windows\SysWOW64\ntos.exe	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

pid	process
1480	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe
1480	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

description pid process

Token: SeDebugPrivilege 1480 928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

description	pid	process
Token: SeDebugPrivilege	1480	928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe

C:\Users\Admin\AppData\Local\Temp\928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe
"C:\Users\Admin\AppData\Local\Temp\928745cdc32bf0c99c4a4f6bd2502922d74d3231c0c98db38c2bd61123b061c3.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1480-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download