8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

Analysis

max time kernel
150s
max time network
196s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 07:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
Size

1.7MB
MD5

ca15699363e15a3ee3f9f165b9da08c1
SHA1

4db16e87e1e5eda16b716530a313b01f320cbe60
SHA256

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b
SHA512

29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf
SSDEEP

3072:OwHl/Gnrl2wGELlyzXq4D2N3v5FQLffCv7oVJNpUpnrT8vp:tB4rlryzIFQLfqvsPfSUv

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 5 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exewinlogon.exe

pid process

884 winlogon.exe
896 winlogon.exe
680 winlogon.exe
1544 winlogon.exe
1572 winlogon.exe

pid	process
884	winlogon.exe
896	winlogon.exe
680	winlogon.exe
1544	winlogon.exe
1572	winlogon.exe

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1512-54-0x0000000000E70000-0x0000000000EAC000-memory.dmp	upx
behavioral1/memory/464-56-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1512-59-0x0000000000E70000-0x0000000000EAC000-memory.dmp	upx
behavioral1/memory/464-60-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/464-61-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/464-65-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/464-66-0x0000000000E70000-0x0000000000EAC000-memory.dmp	upx
\Users\Admin\E696D64614\winlogon.exe	upx
behavioral1/memory/464-68-0x00000000003B0000-0x00000000003EC000-memory.dmp	upx
\Users\Admin\E696D64614\winlogon.exe	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
\Users\Admin\E696D64614\winlogon.exe	upx
\Users\Admin\E696D64614\winlogon.exe	upx
behavioral1/memory/464-73-0x0000000000400000-0x000000000041C000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral1/memory/884-81-0x00000000002A0000-0x00000000002DC000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral1/memory/680-91-0x0000000000400000-0x000000000041C000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx

Loads dropped DLL 4 IoCs

Processes:

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exewinlogon.exe

pid	process
464	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
464	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
884	winlogon.exe
884	winlogon.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 1512 set thread context of 464	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 884 set thread context of 680	884	winlogon.exe	winlogon.exe
PID 680 set thread context of 1544	680	winlogon.exe	winlogon.exe
PID 680 set thread context of 1572	680	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exewinlogon.exe

pid process

464 8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
680 winlogon.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 1512 wrote to memory of 1504	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	svchost.exe
PID 1512 wrote to memory of 1504	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	svchost.exe
PID 1512 wrote to memory of 1504	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	svchost.exe
PID 1512 wrote to memory of 1504	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	svchost.exe
PID 1512 wrote to memory of 464	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 1512 wrote to memory of 464	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 1512 wrote to memory of 464	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 1512 wrote to memory of 464	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 1512 wrote to memory of 464	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 1512 wrote to memory of 464	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 1512 wrote to memory of 464	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 1512 wrote to memory of 464	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 1512 wrote to memory of 464	1512	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
PID 464 wrote to memory of 884	464	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	winlogon.exe
PID 464 wrote to memory of 884	464	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	winlogon.exe
PID 464 wrote to memory of 884	464	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	winlogon.exe
PID 464 wrote to memory of 884	464	8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe	winlogon.exe
PID 884 wrote to memory of 1692	884	winlogon.exe	svchost.exe
PID 884 wrote to memory of 1692	884	winlogon.exe	svchost.exe
PID 884 wrote to memory of 1692	884	winlogon.exe	svchost.exe
PID 884 wrote to memory of 1692	884	winlogon.exe	svchost.exe
PID 884 wrote to memory of 896	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 896	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 896	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 896	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 680	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 680	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 680	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 680	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 680	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 680	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 680	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 680	884	winlogon.exe	winlogon.exe
PID 884 wrote to memory of 680	884	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1544	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1544	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1544	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1544	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1544	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1544	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1544	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1544	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1544	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1572	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1572	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1572	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1572	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1572	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1572	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1572	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1572	680	winlogon.exe	winlogon.exe
PID 680 wrote to memory of 1572	680	winlogon.exe	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
"C:\Users\Admin\AppData\Local\Temp\8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1512

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
2⤵
PID:1504

C:\Users\Admin\AppData\Local\Temp\8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\svchost.exe
4⤵
PID:1692

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
PID:896

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:680

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Executes dropped EXE
PID:1544

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Executes dropped EXE
PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
\Users\Admin\E696D64614\winlogon.exe
Filesize
1.7MB

MD5
ca15699363e15a3ee3f9f165b9da08c1

SHA1
4db16e87e1e5eda16b716530a313b01f320cbe60

SHA256
8925457e1f9fea575610b8506dfefd466a33f6e8b717386efc94c5c1ab00175b

SHA512
29f2218d63d4eff9dba3f48b21617240ac8423f40690d53c115a4b0a86582c176e61f74cba91b1320beb3d59492d1c1b921b4c3eeebd4360e4a758facff234cf

Download Submit
memory/464-57-0x000000000041AA70-mapping.dmp

Download
memory/464-68-0x00000000003B0000-0x00000000003EC000-memory.dmp

Filesize
240KB

Download
memory/464-73-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/464-64-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/464-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/464-66-0x0000000000E70000-0x0000000000EAC000-memory.dmp

Filesize
240KB

Download
memory/464-61-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/464-65-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/464-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/680-78-0x000000000041AA70-mapping.dmp

Download
memory/680-91-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/884-70-0x0000000000000000-mapping.dmp

Download
memory/884-81-0x00000000002A0000-0x00000000002DC000-memory.dmp

Filesize
240KB

Download
memory/1504-55-0x0000000000000000-mapping.dmp

Download
memory/1512-54-0x0000000000E70000-0x0000000000EAC000-memory.dmp

Filesize
240KB

Download
memory/1512-59-0x0000000000E70000-0x0000000000EAC000-memory.dmp

Filesize
240KB

Download
memory/1544-88-0x0000000000441670-mapping.dmp

Download
memory/1572-93-0x0000000000441670-mapping.dmp

Download
memory/1692-74-0x0000000000000000-mapping.dmp

Download