d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851

Analysis

max time kernel
142s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/11/2022, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe
Size

312KB
MD5

92cf46dfa06b1f44d55dc3de7756f83a
SHA1

3c60dccc8a9ebd0cf01c87246606b3d6b91ece67
SHA256

d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851
SHA512

1d1f7930623b5b97825272ad6b6fcf2431b0e4c84949842b82b5b558d1a4a13673d6557aaadf5c2b99baced411016711a588cb28b1b871c16c2a082f72e99954
SSDEEP

6144:qlKLVO7MEOSu+HCh8g7bSmgrcNAcQLVk8To7yy6cNj+aQURvXBsrdR:uIV2mvn8cNA5TEylcljxxqdR

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\D10A9C~1.EXE,"	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D10A9C~1.EXE"	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\654aab24 = "ÿÏg\t\x04Á¾Œâµ(qU\x10:ôöº\u00a0Jû/·AóídÑZ˜Ù§”8\u0090Ú\x14Õbœ\x1bä\tïã\x13GWìŒàëŸÇ“‡[\u008fì¦!ªøCý®\x1fâq²\b§¿¡®°\x1ddÄ`È.DÌ{=\x18¼AŒÜÔV_ö½›/ˆc\x17\x1e›¦c~Äß¤ö”Dúæ,NJ„óë\x1b×–>´>¾ªœÆÛŒKî¬{\x17öÞ¦ÃÍ~–Ö\x14>t\f\vÄ,ƒôŒ\x04k¦üN/%\u00ad…~\x02íçî\x17•–çºóU¿Ë\f\ftÔ\x14fâÍ¬FL¤ŽO·N&çNî¤ü<¬\x7f.òòË\x1c\";\x0eµnFë&¤\|F\x05ô\x15\x02„Ì¤5Dö*Ö–¤üü6¤î\x0e¬ÏJÏÞÚä=Ë\x144Ü~…ÌÇŒ¬®Ä>"	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D10A9C~1.EXE"	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1936	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe
1936	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe
1936	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe
1936	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe
1936	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe
1936	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1936	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe
Token: SeSecurityPrivilege	1936	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe
Token: SeSecurityPrivilege	1936	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe
Token: SeSecurityPrivilege	1936	d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe

C:\Users\Admin\AppData\Local\Temp\d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe
"C:\Users\Admin\AppData\Local\Temp\d10a9c0ac55739884a8301a18c7fd53dad4d3954c2c0a7d8a8e130c26f239851.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-54-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Filesize
8KB

Download
memory/1936-55-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/1936-56-0x0000000000400000-0x0000000000451000-memory.dmp

Filesize
324KB

Download
memory/1936-57-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/1936-59-0x00000000020B0000-0x0000000002162000-memory.dmp

Filesize
712KB

Download
memory/1936-58-0x00000000020B0000-0x0000000002162000-memory.dmp

Filesize
712KB

Download
memory/1936-60-0x00000000020B0000-0x0000000002162000-memory.dmp

Filesize
712KB

Download
memory/1936-62-0x00000000020B0000-0x0000000002162000-memory.dmp

Filesize
712KB

Download
memory/1936-63-0x00000000020B0000-0x0000000002162000-memory.dmp

Filesize
712KB

Download
memory/1936-65-0x00000000020B0000-0x0000000002162000-memory.dmp

Filesize
712KB

Download
memory/1936-66-0x0000000002170000-0x0000000002228000-memory.dmp

Filesize
736KB

Download
memory/1936-67-0x0000000002170000-0x0000000002228000-memory.dmp

Filesize
736KB

Download