Analysis
- max time kernel
171s - max time network
199s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
30/11/2022, 23:37
Static task
static1
Behavioral task
behavioral1
Sample
a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe
- Size 304KB
- Sample221130-3mnbwseh94
- SHA256 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4
- MD5 11bba4cbae0c7e4cf8fcf2e1de528267
- SHA1 eb9b209db744391434ee99dcca7ff1de93200019
- SHA512 2a03d7df48325d75c92e73ce4ed85a0149a8aa48d311f2e06fff5da988ad4b4600b2593cd07fdf0d27390c1679cb43546868f0b5af595b8de79d399bea760e77
- SSDEEP 6144:4YK/7lTZitfjaRhSm7qfDjEGYyiVhK7c3wJplHM0D/2zh:FK/7uaXh+bjEp/AVRDeF
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\A99CF7~1.EXE," a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A99CF7~1.EXE" a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\4f801548 = "±epÀÄÝÅI\b~«u]A«»êhô%\u008f^¬ u<;þ|î˜é(«¹d\x03#iÕ\vYÂVÄ,X\x1b\t¬\x1eò:ö],ÁƒHœ±ÞäŸUD:§þZÁYX" a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A99CF7~1.EXE" a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe Token: SeSecurityPrivilege 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe Token: SeSecurityPrivilege 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe Token: SeSecurityPrivilege 1032 a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe"C:\Users\Admin\AppData\Local\Temp\a99cf71fa1a634f4c5e921b93c31d55f9b98d228bd255bc35a180c543340dbb4.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1032