a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1

Analysis

max time kernel
21s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe
Size

176KB
MD5

a07e6b68e78e8de04ef53dfcbb42ad09
SHA1

c1e8cf1db7b126dbf09170414e7ce84b99e11f85
SHA256

a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1
SHA512

a0328e6ca49b80b37c0f02cebeef4383fd95b0b9f3bd997c18cee3ec2fe6c0d67f5eb2056876462f0d7d30075dd00c39e18288b7244ae5ad4a9991fe769ade1d
SSDEEP

3072:7ofKHb2VlN9ydRo9CTlPgsVG9L4vdyUbW2qFQE4GVpu1Wt:7ofmbEN9BE+WUUvPW2qp4GVp2c

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,C:\\Windows\\system32\\ntos.exe,"	a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe

Drops file in System32 directory 2 IoCs

Processes:

a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ntos.exe	a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe
File created	C:\Windows\SysWOW64\ntos.exe	a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe

pid	process
2016	a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe
2016	a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe

description pid process

Token: SeDebugPrivilege 2016 a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe

description	pid	process
Token: SeDebugPrivilege	2016	a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe

C:\Users\Admin\AppData\Local\Temp\a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe
"C:\Users\Admin\AppData\Local\Temp\a3c0f849270611b2008a39988691f932ae841a07bce7d8f14516fc9ef8e49ad1.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2016-54-0x0000000076711000-0x0000000076713000-memory.dmp

Filesize
8KB

Download
memory/2016-55-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download