Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 05:31
Static task
static1
Behavioral task
behavioral1
Sample
a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe
Resource
win10v2004-20220812-en
General
-
Target
a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe
-
Size
180KB
-
MD5
387b00428d6a7d8c3a4f7a6c6de2bfcb
-
SHA1
d8b20edf5fd13249d15c0b5a6210a0601fd33652
-
SHA256
a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b
-
SHA512
6599c745b9a90aaf86628c032de5fc55c327be9b95731779ddd723348ee164b879c30f1b9387a2d57f49fd33d17008d64d8e266d6d73b85dec15ea7ee343051c
-
SSDEEP
3072:7ofKHb2VlNw6zZvQB1aH7lVRwFizDC/exZBVD0S2H8ju1:7ofmbENfznH7lnblz7gb6u1
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe," a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe -
Drops file in System32 directory 2 IoCs
Processes:
a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exedescription ioc process File opened for modification C:\Windows\SysWOW64\ntos.exe a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe File created C:\Windows\SysWOW64\ntos.exe a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exepid process 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exedescription pid process Token: SeDebugPrivilege 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exedescription pid process target process PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe PID 920 wrote to memory of 592 920 a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe winlogon.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe"C:\Users\Admin\AppData\Local\Temp\a50e9527c9919d115ada3a6337f854cfd77384296e63fb64fbb358a71d20a31b.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/592-182-0x00000000224F0000-0x0000000022514000-memory.dmpFilesize
144KB
-
memory/592-217-0x0000000022640000-0x0000000022664000-memory.dmpFilesize
144KB
-
memory/592-142-0x0000000022370000-0x0000000022394000-memory.dmpFilesize
144KB
-
memory/592-147-0x00000000223A0000-0x00000000223C4000-memory.dmpFilesize
144KB
-
memory/592-152-0x00000000223D0000-0x00000000223F4000-memory.dmpFilesize
144KB
-
memory/592-157-0x0000000022400000-0x0000000022424000-memory.dmpFilesize
144KB
-
memory/592-162-0x0000000022430000-0x0000000022454000-memory.dmpFilesize
144KB
-
memory/592-172-0x0000000022490000-0x00000000224B4000-memory.dmpFilesize
144KB
-
memory/592-227-0x00000000226A0000-0x00000000226C4000-memory.dmpFilesize
144KB
-
memory/592-137-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB
-
memory/592-167-0x0000000022460000-0x0000000022484000-memory.dmpFilesize
144KB
-
memory/592-187-0x0000000022520000-0x0000000022544000-memory.dmpFilesize
144KB
-
memory/592-192-0x0000000022550000-0x0000000022574000-memory.dmpFilesize
144KB
-
memory/592-197-0x0000000022580000-0x00000000225A4000-memory.dmpFilesize
144KB
-
memory/592-202-0x00000000225B0000-0x00000000225D4000-memory.dmpFilesize
144KB
-
memory/592-207-0x00000000225E0000-0x0000000022604000-memory.dmpFilesize
144KB
-
memory/592-212-0x0000000022610000-0x0000000022634000-memory.dmpFilesize
144KB
-
memory/592-177-0x00000000224C0000-0x00000000224E4000-memory.dmpFilesize
144KB
-
memory/592-222-0x0000000022670000-0x0000000022694000-memory.dmpFilesize
144KB
-
memory/920-132-0x0000000000400000-0x0000000000424000-memory.dmpFilesize
144KB