Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
01-12-2022 00:59
Static task
static1
Behavioral task
behavioral1
Sample
8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe
Resource
win10v2004-20220901-en
General
-
Target
8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe
-
Size
762KB
-
MD5
0ed9af9dee28109f70002a762566413f
-
SHA1
11b7c7c44006636a779cca150443841145d0db23
-
SHA256
8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e
-
SHA512
1ea7e142a7c46c3335711d1e06d471d82fda6a22bbf73ec87b27f9e86ab130ecbbe8130f09deb66bb33df95ca82f0a20e05849b20730491403ff46976777301b
-
SSDEEP
12288:30jpc+Bl7sGIE196M/txC14ZLBsQJaBSY0bHqm2a0YkJJx+w2HOa90lHhQyZfnYa:4pJBNsEjlz84VBs8+X0bqyN6x+w2Hl94
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Windowswinlogon.exeWindowswinlogon.exepid process 4812 Windowswinlogon.exe 4876 Windowswinlogon.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Windowswinlogon.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Windowswinlogon.exe" Windowswinlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\Windowswinlogon.exe" Windowswinlogon.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Windowswinlogon.exedescription pid process target process PID 4812 set thread context of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exeWindowswinlogon.exepid process 4896 8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe 4896 8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe 4812 Windowswinlogon.exe 4812 Windowswinlogon.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
Windowswinlogon.exedescription pid process Token: SeIncreaseQuotaPrivilege 4876 Windowswinlogon.exe Token: SeSecurityPrivilege 4876 Windowswinlogon.exe Token: SeTakeOwnershipPrivilege 4876 Windowswinlogon.exe Token: SeLoadDriverPrivilege 4876 Windowswinlogon.exe Token: SeSystemProfilePrivilege 4876 Windowswinlogon.exe Token: SeSystemtimePrivilege 4876 Windowswinlogon.exe Token: SeProfSingleProcessPrivilege 4876 Windowswinlogon.exe Token: SeIncBasePriorityPrivilege 4876 Windowswinlogon.exe Token: SeCreatePagefilePrivilege 4876 Windowswinlogon.exe Token: SeBackupPrivilege 4876 Windowswinlogon.exe Token: SeRestorePrivilege 4876 Windowswinlogon.exe Token: SeShutdownPrivilege 4876 Windowswinlogon.exe Token: SeDebugPrivilege 4876 Windowswinlogon.exe Token: SeSystemEnvironmentPrivilege 4876 Windowswinlogon.exe Token: SeChangeNotifyPrivilege 4876 Windowswinlogon.exe Token: SeRemoteShutdownPrivilege 4876 Windowswinlogon.exe Token: SeUndockPrivilege 4876 Windowswinlogon.exe Token: SeManageVolumePrivilege 4876 Windowswinlogon.exe Token: SeImpersonatePrivilege 4876 Windowswinlogon.exe Token: SeCreateGlobalPrivilege 4876 Windowswinlogon.exe Token: 33 4876 Windowswinlogon.exe Token: 34 4876 Windowswinlogon.exe Token: 35 4876 Windowswinlogon.exe Token: 36 4876 Windowswinlogon.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exeWindowswinlogon.execmd.exenet.exedescription pid process target process PID 4896 wrote to memory of 4812 4896 8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe Windowswinlogon.exe PID 4896 wrote to memory of 4812 4896 8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe Windowswinlogon.exe PID 4896 wrote to memory of 4812 4896 8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe Windowswinlogon.exe PID 4812 wrote to memory of 4864 4812 Windowswinlogon.exe cmd.exe PID 4812 wrote to memory of 4864 4812 Windowswinlogon.exe cmd.exe PID 4812 wrote to memory of 4864 4812 Windowswinlogon.exe cmd.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4812 wrote to memory of 4876 4812 Windowswinlogon.exe Windowswinlogon.exe PID 4864 wrote to memory of 4644 4864 cmd.exe net.exe PID 4864 wrote to memory of 4644 4864 cmd.exe net.exe PID 4864 wrote to memory of 4644 4864 cmd.exe net.exe PID 4644 wrote to memory of 848 4644 net.exe net1.exe PID 4644 wrote to memory of 848 4644 net.exe net1.exe PID 4644 wrote to memory of 848 4644 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe"C:\Users\Admin\AppData\Local\Temp\8e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windowswinlogon.exeC:\Windowswinlogon.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exenet stop MpsSvc4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc5⤵
-
C:\Windowswinlogon.exeC:\Windowswinlogon.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windowswinlogon.exeFilesize
762KB
MD50ed9af9dee28109f70002a762566413f
SHA111b7c7c44006636a779cca150443841145d0db23
SHA2568e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e
SHA5121ea7e142a7c46c3335711d1e06d471d82fda6a22bbf73ec87b27f9e86ab130ecbbe8130f09deb66bb33df95ca82f0a20e05849b20730491403ff46976777301b
-
C:\Windowswinlogon.exeFilesize
762KB
MD50ed9af9dee28109f70002a762566413f
SHA111b7c7c44006636a779cca150443841145d0db23
SHA2568e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e
SHA5121ea7e142a7c46c3335711d1e06d471d82fda6a22bbf73ec87b27f9e86ab130ecbbe8130f09deb66bb33df95ca82f0a20e05849b20730491403ff46976777301b
-
C:\Windowswinlogon.exeFilesize
762KB
MD50ed9af9dee28109f70002a762566413f
SHA111b7c7c44006636a779cca150443841145d0db23
SHA2568e45651905f70f9ba0bf329c8eb38c1c6c167694e3c8fd2a32f97c7933a4632e
SHA5121ea7e142a7c46c3335711d1e06d471d82fda6a22bbf73ec87b27f9e86ab130ecbbe8130f09deb66bb33df95ca82f0a20e05849b20730491403ff46976777301b
-
memory/848-143-0x0000000000000000-mapping.dmp
-
memory/4644-142-0x0000000000000000-mapping.dmp
-
memory/4812-132-0x0000000000000000-mapping.dmp
-
memory/4864-136-0x0000000000000000-mapping.dmp
-
memory/4876-141-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4876-140-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4876-138-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4876-137-0x0000000000000000-mapping.dmp
-
memory/4876-144-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4876-145-0x0000000000400000-0x00000000004B1000-memory.dmpFilesize
708KB
-
memory/4896-134-0x0000000000550000-0x0000000000556000-memory.dmpFilesize
24KB