171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029

General

Target

171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
Size

16KB
MD5

43a782844721f02d589ad04b3cd39520
SHA1

0fd24c743c7d8a6a6bbcd881b67d2c42c6f1b76b
SHA256

171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029
SHA512

c9bf4a3854f38bf5af17439727d572c78c7e196c53ff51280f71a6c76f4ccefe4951b62562ab78a42fe4ccc71fbbef81125fe90d529030befd48ac995d0c89e2
SSDEEP

384:/0bKAy5N0ZmXIV0lZw2kINGvn3OAHuxW3BuWAN:uO3emjLZAhOk4

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 64 IoCs

Processes:

171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\cttunesvr.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\msdt.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\sc.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\sxstrace.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\choice.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\diskraid.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\gpupdate.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\label.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\ndadmin.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\NETSTAT.EXE	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\OptionalFeatures.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\Robocopy.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\bitsadmin.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\mshta.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\dpnsvr.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\dnscacheugc.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\iexpress.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\lodctr.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\notepad.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\PING.EXE	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\regedt32.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\compact.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\dxdiag.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\hh.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\osk.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\perfhost.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\rasdial.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\diantz.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\powercfg.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\RmClient.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\sfc.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\verifier.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\gpscript.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\comp.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\DeviceProperties.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\fixmapi.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\InfDefaultInstall.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\LocationNotifications.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\makecab.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\odbcad32.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\certutil.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\reg.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\nslookup.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\DpiScaling.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\forfiles.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\icardagt.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\dllhst3g.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\dllhost.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\rdrleakdiag.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\write.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\dfrgui.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\netiougc.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\runonce.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\WPDShextAutoplay.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\extrac32.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\ntkrnlpa.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\RMActivate_isv.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\SecEdit.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\xwizard.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\MuiUnattend.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\eventcreate.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\rasphone.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\SysWOW64\svchost.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe

Drops file in Windows directory 11 IoCs

Processes:

171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe

description	ioc	process
File opened for modification	C:\Windows\HelpPane.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\notepad.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\twunk_16.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\explorer.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\fveupdate.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\hh.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\splwow64.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\twunk_32.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\winhlp32.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\write.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
File opened for modification	C:\Windows\bfsvc.exe	171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe

Enumerates system info in registry 2 TTPs 32 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

csrss.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize"	winlogon.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

AUDIODG.EXELogonUI.exe

description	pid	process
Token: 33	644	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	644	AUDIODG.EXE
Token: 33	644	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	644	AUDIODG.EXE
Token: SeShutdownPrivilege	2028	LogonUI.exe
Token: SeShutdownPrivilege	2028	LogonUI.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

csrss.exewinlogon.exe

description	pid	process	target process
PID 1844 wrote to memory of 2028	1844	csrss.exe	LogonUI.exe
PID 1844 wrote to memory of 2028	1844	csrss.exe	LogonUI.exe
PID 1532 wrote to memory of 2028	1532	winlogon.exe	LogonUI.exe
PID 1532 wrote to memory of 2028	1532	winlogon.exe	LogonUI.exe
PID 1532 wrote to memory of 2028	1532	winlogon.exe	LogonUI.exe
PID 1844 wrote to memory of 2028	1844	csrss.exe	LogonUI.exe
PID 1844 wrote to memory of 2028	1844	csrss.exe	LogonUI.exe
PID 1844 wrote to memory of 2028	1844	csrss.exe	LogonUI.exe
PID 1844 wrote to memory of 2028	1844	csrss.exe	LogonUI.exe
PID 1844 wrote to memory of 2028	1844	csrss.exe	LogonUI.exe
PID 1844 wrote to memory of 2028	1844	csrss.exe	LogonUI.exe
PID 1844 wrote to memory of 2028	1844	csrss.exe	LogonUI.exe
PID 1844 wrote to memory of 2028	1844	csrss.exe	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe
"C:\Users\Admin\AppData\Local\Temp\171d8ce2768d0bb748c49cf33a4a950d4e6111b28852640fb3d47cbe72244029.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:900

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:268

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1e0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1532

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-56-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download
memory/900-54-0x0000000001000000-0x0000000001007B00-memory.dmp

Filesize
30KB

Download
memory/900-55-0x0000000001000000-0x0000000001007B00-memory.dmp

Filesize
30KB

Download
memory/2028-57-0x0000000000000000-mapping.dmp

Download
memory/2028-58-0x000007FEFB421000-0x000007FEFB423000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads