5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9

General

Target

5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
Size

456KB
MD5

2202e1c883da159adfe37e6e59779f4c
SHA1

822703c997d1c760a3a2d99778962adce3921a5b
SHA256

5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9
SHA512

6c8485d536bd85b978267b64e224fdcabe51f2faec4d2134712af0393221faf3e4eb68ad35069c756b0ca7d28b3f49ed509899a839e643f560fbe4f9bfccf97e
SSDEEP

12288:pMSU4joci8M6PW1GVFeFd60DFUyheaYM:iSUCpM2W1Gvgmyeav

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe"	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\userini = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe"	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe

pid	process
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe

pid	process
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
940	5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe

C:\Users\Admin\AppData\Local\Temp\5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe
"C:\Users\Admin\AppData\Local\Temp\5e136cef32e307fe0857890c8e24e86d26bff7fdcb8d7369f8d20c148f4bfbc9.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:940

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1312

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads