8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa

General

Target

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
Size

252KB
MD5

9c3c2d233af68d4db475af9a92936527
SHA1

1cc52fbb0489470ce88411960b498554dcad7786
SHA256

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa
SHA512

25fd014db666a8a6602aae5531266d4b890054709f5e9090b00949526b55f99a429a5edca5243a7f0947b78b21312cb70e6b4986fea07e400a4280c078173858
SSDEEP

6144:Yg9SJ3GmB+gw8quOMdwD5xTse7P+BMbA5QwEgNV0gShqlHfl:FSJWmMB6OM6VxAeD+qbA5LEgNKhCHfl

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\8C9AFA~1.EXE,"	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8C9AFA~1.EXE"	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Scanning
T1046

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\71f4f100 = "D\\Z\x1b‘‰v<–ËÃû¾z\bFšB‚/ðnÔ:ø$¥œJè¢B7*Þu³µ©Æ\x02Ý®?ð(¨£G—\x1a¯\x06\|†\x01\x12U%\"Â&ú´\u0090ß‹`\nj\x7fú\"DþPnÒb®H¯e\x03&XF\x04ÔZÉ\r\x02¯•FN6Ò3&åç¬6"	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8C9AFA~1.EXE"	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

pid	process
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

description	pid	process
Token: SeSecurityPrivilege	1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
Token: SeSecurityPrivilege	1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
Token: SeSecurityPrivilege	1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
Token: SeSecurityPrivilege	1952	8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe

C:\Users\Admin\AppData\Local\Temp\8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe
"C:\Users\Admin\AppData\Local\Temp\8c9afafb0efb7a3e581ca7532559fc61e6e68453d7b25af593a213087a6120aa.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Network Service Scanning

1

T1046

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1952-132-0x0000000002100000-0x0000000002166000-memory.dmp

Filesize
408KB

Download
memory/1952-133-0x0000000000400000-0x0000000000476000-memory.dmp

Filesize
472KB

Download
memory/1952-134-0x0000000002170000-0x0000000002222000-memory.dmp

Filesize
712KB

Download
memory/1952-135-0x00000000027A0000-0x0000000002858000-memory.dmp

Filesize
736KB

Download
memory/1952-136-0x0000000002100000-0x0000000002166000-memory.dmp

Filesize
408KB

Download
memory/1952-137-0x00000000027A0000-0x0000000002858000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads