Analysis
-
max time kernel
26s -
max time network
30s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 12:41
Static task
static1
Behavioral task
behavioral1
Sample
f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe
Resource
win10v2004-20220812-en
General
-
Target
f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe
-
Size
88KB
-
MD5
ecfffac1d30e19d63d6b432a07f0a45d
-
SHA1
2b2448a47abc3904cc68c40d9b9caad52d1c06cb
-
SHA256
f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734
-
SHA512
15bf563a16f56c04dd1c4161561235f792b0d00b31468c161b684347ce863bfddd090e80586e4d9f8655c7d7b19d8e32b12c8135554160ee964b2a29358b2b3e
-
SSDEEP
768:yNjV5mQQcLcQ33CmY7dXYY+kWzH9SE/mO5ge6EqIPrcGpORnMYMjo5V0UU6D4Wcv:yJ2ILDCeYXSH26LzrcG9Y5P0WcHOjk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
csrss.exepid process 116 csrss.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exewinlogon.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation winlogon.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
winlogon.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe" csrss.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\SubFolder\\SubFolder\\winlogon.exe" csrss.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 checkip.dyndns.org -
Suspicious use of SetThreadContext 1 IoCs
Processes:
winlogon.exedescription pid process target process PID 384 set thread context of 5052 384 winlogon.exe winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
winlogon.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ winlogon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exewinlogon.execsrss.exepid process 4500 f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe 4500 f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe 384 winlogon.exe 384 winlogon.exe 384 winlogon.exe 384 winlogon.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe 116 csrss.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exepid process 4500 f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exewinlogon.execsrss.exewinlogon.exedescription pid process Token: SeDebugPrivilege 4500 f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe Token: SeDebugPrivilege 384 winlogon.exe Token: SeDebugPrivilege 384 winlogon.exe Token: SeDebugPrivilege 116 csrss.exe Token: SeDebugPrivilege 116 csrss.exe Token: SeDebugPrivilege 5052 winlogon.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exewinlogon.exedescription pid process target process PID 4500 wrote to memory of 384 4500 f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe winlogon.exe PID 4500 wrote to memory of 384 4500 f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe winlogon.exe PID 4500 wrote to memory of 384 4500 f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe winlogon.exe PID 384 wrote to memory of 5052 384 winlogon.exe winlogon.exe PID 384 wrote to memory of 5052 384 winlogon.exe winlogon.exe PID 384 wrote to memory of 5052 384 winlogon.exe winlogon.exe PID 384 wrote to memory of 5052 384 winlogon.exe winlogon.exe PID 384 wrote to memory of 5052 384 winlogon.exe winlogon.exe PID 384 wrote to memory of 5052 384 winlogon.exe winlogon.exe PID 384 wrote to memory of 5052 384 winlogon.exe winlogon.exe PID 384 wrote to memory of 5052 384 winlogon.exe winlogon.exe PID 384 wrote to memory of 116 384 winlogon.exe csrss.exe PID 384 wrote to memory of 116 384 winlogon.exe csrss.exe PID 384 wrote to memory of 116 384 winlogon.exe csrss.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe"C:\Users\Admin\AppData\Local\Temp\f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5052 -
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe"C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exe" -keyhide -prochide 5052 -reg C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe -proc 5052 C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\winlogon.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\winlogon.exe.logFilesize
312B
MD51754173b0ed4624c61fcf04f894e5bb6
SHA12fbf7999a2e14f19c9aeb1ac0e58b8a3859368b1
SHA25619e1f5731300f62cc4bb6eac90e96b7ff5de1bf8c13a434f1a7e38ee6927d757
SHA51263ae7b7da19c5b65ce73565042cf7386c8d53ab6645b901a9f684d5039e28addd91938d8d61cec153b675e80c25d92fae62bff53edf19914643c94f3a56db710
-
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exeFilesize
88KB
MD5ecfffac1d30e19d63d6b432a07f0a45d
SHA12b2448a47abc3904cc68c40d9b9caad52d1c06cb
SHA256f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734
SHA51215bf563a16f56c04dd1c4161561235f792b0d00b31468c161b684347ce863bfddd090e80586e4d9f8655c7d7b19d8e32b12c8135554160ee964b2a29358b2b3e
-
C:\Users\Admin\AppData\Roaming\SubFolder\SubFolder\csrss.exeFilesize
88KB
MD5ecfffac1d30e19d63d6b432a07f0a45d
SHA12b2448a47abc3904cc68c40d9b9caad52d1c06cb
SHA256f626b79602eb4ab88c08eca8b2634847d0ea48ce03f08c78cb828655f252c734
SHA51215bf563a16f56c04dd1c4161561235f792b0d00b31468c161b684347ce863bfddd090e80586e4d9f8655c7d7b19d8e32b12c8135554160ee964b2a29358b2b3e
-
memory/116-145-0x00000000748B0000-0x0000000074E61000-memory.dmpFilesize
5.7MB
-
memory/116-142-0x0000000000000000-mapping.dmp
-
memory/384-133-0x0000000000000000-mapping.dmp
-
memory/384-134-0x00000000748B0000-0x0000000074E61000-memory.dmpFilesize
5.7MB
-
memory/384-146-0x00000000748B0000-0x0000000074E61000-memory.dmpFilesize
5.7MB
-
memory/4500-135-0x00000000748B0000-0x0000000074E61000-memory.dmpFilesize
5.7MB
-
memory/4500-132-0x00000000748B0000-0x0000000074E61000-memory.dmpFilesize
5.7MB
-
memory/5052-136-0x0000000000000000-mapping.dmp
-
memory/5052-141-0x00000000748B0000-0x0000000074E61000-memory.dmpFilesize
5.7MB
-
memory/5052-139-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/5052-138-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/5052-147-0x00000000748B0000-0x0000000074E61000-memory.dmpFilesize
5.7MB
-
memory/5052-137-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB