8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa

General

Target

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
Size

252KB
MD5

9c3c2d233af68d4db475af9a92936527
SHA1

1cc52fbb0489470ce88411960b498554dcad7786
SHA256

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa
SHA512

25fd014db666a8a6602aae5531266d4b890054709f5e9090b00949526b55f99a429a5edca5243a7f0947b78b21312cb70e6b4986fea07e400a4280c078173858
SSDEEP

6144:Yg9SJ3GmB+gw8quOMdwD5xTse7P+BMbA5QwEgNV0gShqlHfl:FSJWmMB6OM6VxAeD+qbA5LEgNKhCHfl

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\8C9AFA~1.EXE,"	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8C9AFA~1.EXE"	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\c2808cf3 = "\x13\x11Ì\x16ð§®Ë\x10ƒ\x14çrug¢‹êˆÝzÕ DìÙ1Ÿ¸76‹snÎÙR½D5\b\të~B@Sù)—î’‚»!/\a©fIS\x13\x02°m›Ö\nQ\x1aRðëû\x1fƒ,j©'ÕAÅw©‰…eã8“ªZ\u008d\x1eXª·&á«ÿl*CBÈœ2;Ã{Ló4Û›Ã\|“üèðš\v{Æ»þ(,k\vlºÃpä\vSŒ‹s\|®XÚük\x04{XŠ«ÃcR¼.8ìÃÜ”RtÊ\b#\\\u0090+;Ð4ÚkÞ"	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8C9AFA~1.EXE"	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

pid	process
1352	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1352	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1352	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1352	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1352	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1352	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1352	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

description	pid	process
Token: SeSecurityPrivilege	1352	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
Token: SeSecurityPrivilege	1352	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
Token: SeSecurityPrivilege	1352	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
Token: SeSecurityPrivilege	1352	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

C:\Users\Admin\AppData\Local\Temp\8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
"C:\Users\Admin\AppData\Local\Temp\8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1352-54-0x0000000000230000-0x0000000000296000-memory.dmp

Filesize
408KB

Download
memory/1352-55-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1352-57-0x00000000024D0000-0x0000000002582000-memory.dmp

Filesize
712KB

Download
memory/1352-56-0x00000000024D0000-0x0000000002582000-memory.dmp

Filesize
712KB

Download
memory/1352-58-0x00000000024D0000-0x0000000002582000-memory.dmp

Filesize
712KB

Download
memory/1352-61-0x00000000024D0000-0x0000000002582000-memory.dmp

Filesize
712KB

Download
memory/1352-60-0x00000000024D0000-0x0000000002582000-memory.dmp

Filesize
712KB

Download
memory/1352-63-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1352-64-0x00000000024D0000-0x0000000002582000-memory.dmp

Filesize
712KB

Download
memory/1352-65-0x0000000002690000-0x0000000002748000-memory.dmp

Filesize
736KB

Download
memory/1352-66-0x0000000000230000-0x0000000000296000-memory.dmp

Filesize
408KB

Download
memory/1352-67-0x0000000002690000-0x0000000002748000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads