3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f

General

Target

3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
Size

250KB
MD5

1bb47165d28be158937ae23e097ccc20
SHA1

e2cc477985a228220d9113b09d0948448c2afdac
SHA256

3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f
SHA512

0d88e13e1e855893a3179fbe1e21d3dd24850d96a61b7c091ba09372dddfa3d35ee33b89c54b8b2356450386fa07c91510a1f95cb017e580605b79cd9ca02865
SSDEEP

6144:mcjlsubtn6BV+/1PSSggDhBkLq2pjMoyYKRKESBv:riuZ6Bq1aMWqBTSV

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\3306A3~1.EXE,"	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3306A3~1.EXE"	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\d63fb796 = "\x1f05ˆ•7\aö\x19íŠknÑxƒ_©~M!XíK2,\x1eá;e¿”¦~ýâ·\u008fàj\x1f˜€\x10ò¥òˆ\x7fY`€\x15þÍ\n\x1c\u00a0\"•šÔj\u00901x¯\x0fÌj7zÂ\rž9Ýl…?¢+\x1f`ÜIãð¥Ó¨º‰`Šl\|ëa´wp!\t„ÇÜ)_\x0eí7ì\x05âÁ<þÌ·‚\x1fßn]:Já\x0fL?\x02ÏéÖçFÇO\u008f©\x17I}±/šêBæ\r\x15Å™¢ñ\u00ad\x14\x0f±Ô¡^Ì¦áÁò±·\x17G\u009dŠåMÇ‰:ÂÇä¡\tR\x0f'1^-\r\x14™\u0081>Žg\x16\x7f)šZ\x17o9…\x17ïáq\"\aÊÌ÷M§\x01îu\x0fß\x17gžŸÆ\x15ú®Œï\u008f™eÁÔv¦ÌRAÏíÆv\|g„DÏw_¾ñ)ì\x05E‡"	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3306A3~1.EXE"	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe

pid	process
2004	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
2004	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
2004	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
2004	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
2004	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
2004	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
2004	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe

description	pid	process
Token: SeSecurityPrivilege	2004	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
Token: SeSecurityPrivilege	2004	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
Token: SeSecurityPrivilege	2004	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
Token: SeSecurityPrivilege	2004	3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe

C:\Users\Admin\AppData\Local\Temp\3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe
"C:\Users\Admin\AppData\Local\Temp\3306a361977b320f624497848bc60b59a9c32f71169e0602995ce13f6c7ec10f.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

2

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2004-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/2004-55-0x000000007EF40000-0x000000007EFA7000-memory.dmp

Filesize
412KB

Download
memory/2004-56-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2004-58-0x00000000023A0000-0x0000000002452000-memory.dmp

Filesize
712KB

Download
memory/2004-57-0x00000000023A0000-0x0000000002452000-memory.dmp

Filesize
712KB

Download
memory/2004-59-0x00000000023A0000-0x0000000002452000-memory.dmp

Filesize
712KB

Download
memory/2004-62-0x00000000023A0000-0x0000000002452000-memory.dmp

Filesize
712KB

Download
memory/2004-61-0x00000000023A0000-0x0000000002452000-memory.dmp

Filesize
712KB

Download
memory/2004-64-0x00000000023A0000-0x0000000002452000-memory.dmp

Filesize
712KB

Download
memory/2004-65-0x0000000002560000-0x0000000002618000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads