1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883

Analysis

max time kernel
3s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe
Size

169KB
MD5

9b1cbb32f79c298a470528afc224b96f
SHA1

3b4f9f2e1aa296e0c43d7a947a343e206daacf1a
SHA256

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883
SHA512

b74f92125c457d743efab7f4248f5778ace3ecd364481a186d3710c0d4ff1cf7953623095fce2b127db050839ed71ab3bf41ab0343fbde24a08dd099531b0bc7
SSDEEP

3072:7ofKHb2VlN9MzltqZLu/VmJIQNVyztshXOiffa/qQXU:7ofmbENoc2s5yi+qa//E

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,C:\\Windows\\system32\\ntos.exe,"	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

Drops file in System32 directory 2 IoCs

Processes:

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\ntos.exe	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe
File created	C:\Windows\SysWOW64\ntos.exe	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

pid	process
956	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe
956	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

description pid process

Token: SeDebugPrivilege 956 1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

description	pid	process
Token: SeDebugPrivilege	956	1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe

C:\Users\Admin\AppData\Local\Temp\1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe
"C:\Users\Admin\AppData\Local\Temp\1823b43aec2bb38e03a87fe0abc3350484571b899d0ce18dfc2a87cb730cc883.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-54-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/956-55-0x0000000075891000-0x0000000075893000-memory.dmp

Filesize
8KB

Download
memory/956-56-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads