Analysis
-
max time kernel
199s -
max time network
216s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 08:36
Static task
static1
Behavioral task
behavioral1
Sample
c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe
Resource
win10v2004-20220812-en
General
-
Target
c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe
-
Size
105KB
-
MD5
92c535addeff7ecac919e373556bfb79
-
SHA1
a50acb99696bd4ddc1556610f3d0427188572056
-
SHA256
c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e
-
SHA512
8acc0fbbfa89f85d7a81e8f60faad0734dfe5e7a48d9ea14904143dfc5e5ab3a6ead840aad03137299b93d177bf6fd15632aae02713b2bf8d3a14959d1a849f7
-
SSDEEP
1536:vJzZEdih8l1KrHiujC0MGyzGWfLTO368NVrVwR5b29S/S9f0SInJP:RzZEdih8l1qHi+jgLRG+h2wnSInJ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Winlogon.exeWinlogon.exepid process 1448 Winlogon.exe 3944 Winlogon.exe -
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe -
Drops startup file 2 IoCs
Processes:
Winlogon.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\27501c16f97ef83b27996be6844bc1a0.exe Winlogon.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\27501c16f97ef83b27996be6844bc1a0.exe Winlogon.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exeWinlogon.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zHDMdBkDZC = "C:\\Users\\Admin\\AppData\\Roaming\\EkZQTmNeLd\\CaSfYAGrKE.exe" c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\27501c16f97ef83b27996be6844bc1a0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Winlogon.exe\" .." Winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\27501c16f97ef83b27996be6844bc1a0 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Winlogon.exe\" .." Winlogon.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exeWinlogon.exedescription pid process target process PID 2084 set thread context of 1088 2084 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe PID 1448 set thread context of 3944 1448 Winlogon.exe Winlogon.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exepid process 1088 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe 1088 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exeWinlogon.exedescription pid process Token: SeDebugPrivilege 1088 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe Token: SeDebugPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe Token: 33 3944 Winlogon.exe Token: SeIncBasePriorityPrivilege 3944 Winlogon.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exec67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exeWinlogon.exeWinlogon.exedescription pid process target process PID 2084 wrote to memory of 1088 2084 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe PID 2084 wrote to memory of 1088 2084 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe PID 2084 wrote to memory of 1088 2084 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe PID 2084 wrote to memory of 1088 2084 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe PID 2084 wrote to memory of 1088 2084 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe PID 2084 wrote to memory of 1088 2084 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe PID 2084 wrote to memory of 1088 2084 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe PID 2084 wrote to memory of 1088 2084 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe PID 1088 wrote to memory of 1448 1088 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe Winlogon.exe PID 1088 wrote to memory of 1448 1088 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe Winlogon.exe PID 1088 wrote to memory of 1448 1088 c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe Winlogon.exe PID 1448 wrote to memory of 3944 1448 Winlogon.exe Winlogon.exe PID 1448 wrote to memory of 3944 1448 Winlogon.exe Winlogon.exe PID 1448 wrote to memory of 3944 1448 Winlogon.exe Winlogon.exe PID 1448 wrote to memory of 3944 1448 Winlogon.exe Winlogon.exe PID 1448 wrote to memory of 3944 1448 Winlogon.exe Winlogon.exe PID 1448 wrote to memory of 3944 1448 Winlogon.exe Winlogon.exe PID 1448 wrote to memory of 3944 1448 Winlogon.exe Winlogon.exe PID 1448 wrote to memory of 3944 1448 Winlogon.exe Winlogon.exe PID 3944 wrote to memory of 3520 3944 Winlogon.exe netsh.exe PID 3944 wrote to memory of 3520 3944 Winlogon.exe netsh.exe PID 3944 wrote to memory of 3520 3944 Winlogon.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe"C:\Users\Admin\AppData\Local\Temp\c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe"C:\Users\Admin\AppData\Local\Temp\c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\Winlogon.exe"C:\Users\Admin\AppData\Local\Temp\Winlogon.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\Winlogon.exe"C:\Users\Admin\AppData\Local\Temp\Winlogon.exe"4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Winlogon.exe" "Winlogon.exe" ENABLE5⤵
- Modifies Windows Firewall
PID:3520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Winlogon.exe.logFilesize
507B
MD576ffb2f33cb32ade8fc862a67599e9d8
SHA1920cc4ab75b36d2f9f6e979b74db568973c49130
SHA256f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310
SHA512f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e
-
C:\Users\Admin\AppData\Local\Temp\Winlogon.exeFilesize
105KB
MD592c535addeff7ecac919e373556bfb79
SHA1a50acb99696bd4ddc1556610f3d0427188572056
SHA256c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e
SHA5128acc0fbbfa89f85d7a81e8f60faad0734dfe5e7a48d9ea14904143dfc5e5ab3a6ead840aad03137299b93d177bf6fd15632aae02713b2bf8d3a14959d1a849f7
-
C:\Users\Admin\AppData\Local\Temp\Winlogon.exeFilesize
105KB
MD592c535addeff7ecac919e373556bfb79
SHA1a50acb99696bd4ddc1556610f3d0427188572056
SHA256c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e
SHA5128acc0fbbfa89f85d7a81e8f60faad0734dfe5e7a48d9ea14904143dfc5e5ab3a6ead840aad03137299b93d177bf6fd15632aae02713b2bf8d3a14959d1a849f7
-
C:\Users\Admin\AppData\Local\Temp\Winlogon.exeFilesize
105KB
MD592c535addeff7ecac919e373556bfb79
SHA1a50acb99696bd4ddc1556610f3d0427188572056
SHA256c67670460262b6989bf0c63768bbb7be30286c3ce652d699831eb0b934d5bd4e
SHA5128acc0fbbfa89f85d7a81e8f60faad0734dfe5e7a48d9ea14904143dfc5e5ab3a6ead840aad03137299b93d177bf6fd15632aae02713b2bf8d3a14959d1a849f7
-
memory/1088-136-0x0000000000000000-mapping.dmp
-
memory/1088-137-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/1448-138-0x0000000000000000-mapping.dmp
-
memory/2084-135-0x0000000005050000-0x00000000050EC000-memory.dmpFilesize
624KB
-
memory/2084-132-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/2084-134-0x0000000004950000-0x00000000049E2000-memory.dmpFilesize
584KB
-
memory/2084-133-0x0000000004AA0000-0x0000000005044000-memory.dmpFilesize
5.6MB
-
memory/3520-145-0x0000000000000000-mapping.dmp
-
memory/3944-141-0x0000000000000000-mapping.dmp
-
memory/3944-146-0x0000000005590000-0x000000000559A000-memory.dmpFilesize
40KB