9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740

General

Target

9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
Size

276KB
MD5

410b46097e1eed5ea26e26e39266f3f0
SHA1

905eb502653c0d08d92417336e6b88466901d20e
SHA256

9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740
SHA512

d9d28c8660b1d5ca8246c70d1a2656200ab019f504c85cb276d838c51d8362ba1a10990c9150194bc71f7f08b18cc5aac25f3f78a1aa3f2a15472b64311107d3
SSDEEP

6144:K/1HnOBywO+PnbfMIQFSQMX0Wy6XtdFCGJvi5w:KNQuU1XXdyvGJo

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\9496D5~1.EXE,"	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9496D5~1.EXE"	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\503796e5 = "B‹NDG`™šep>¬ÒË\t¸á!Æ\x10W¤mµÂÂ4M—¡\x0fôq\reÝD{\x0eîä‘?çBéü\x19ìÀ\x1d›‚'wy\\l‹O\nT½÷F1VŸ@p`\x7fQ@Ì\"\x1füâ$HIáv@Ó:hÇ¦\x05ÂÖšq\u009d•½\|ï‹H«\rÜëË\x1dÛ¡äCõÌtãµƒRÕ)rÒ\t}S+\u0081yñÓ\v\n…ü-j)ƒC\x05\x15¬Cýµr\ryâ™CÜÝÕª\x1dÓ\vÍ\x03%åÓisCÁíM™Ù\x13³\r$C³åå\|)ikýCû…¹éìƒÉaK“ñ,»[Ûimc¢\x15³\u0081\rD)±›¬´A\x01+]íAý‚\\ƒ™\x12\x01‹Í•œryA}Û}=”\x13\x12\x11\x05áå%ui¥ã5$ý5ò[écÝ"	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9496D5~1.EXE"	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
Token: SeSecurityPrivilege	864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
Token: SeSecurityPrivilege	864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
Token: SeSecurityPrivilege	864	9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe

C:\Users\Admin\AppData\Local\Temp\9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe
"C:\Users\Admin\AppData\Local\Temp\9496d5e2669d12ec121bd4a99b9166b054e9ad2918261734dea195fc43582740.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/864-54-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/864-55-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/864-56-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/864-58-0x0000000002330000-0x00000000023E2000-memory.dmp

Filesize
712KB

Download
memory/864-57-0x0000000002330000-0x00000000023E2000-memory.dmp

Filesize
712KB

Download
memory/864-59-0x0000000002330000-0x00000000023E2000-memory.dmp

Filesize
712KB

Download
memory/864-61-0x0000000002330000-0x00000000023E2000-memory.dmp

Filesize
712KB

Download
memory/864-62-0x0000000002330000-0x00000000023E2000-memory.dmp

Filesize
712KB

Download
memory/864-65-0x00000000024F0000-0x00000000025A8000-memory.dmp

Filesize
736KB

Download
memory/864-64-0x0000000002330000-0x00000000023E2000-memory.dmp

Filesize
712KB

Download
memory/864-66-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/864-67-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/864-68-0x00000000024F0000-0x00000000025A8000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads