94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a

Analysis

max time kernel
138s
max time network
179s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
Size

272KB
MD5

b767cd6ec8946f2d5982481f90189409
SHA1

cd3737cedca224d356e6fb22a3bd5609de145b7a
SHA256

94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a
SHA512

3667f2685a8fbcd63064fbfd640245ac817d9b4f5fb30e061900ae83f98f9fb5e2a1cb2fa10606ed307af209afd14a86a08875601e1146f5a5473cb53c245646
SSDEEP

6144:FulefVQZmjP103MYhl31T1HQd3TMtMw0g9PPrMHNw:Ust3129bgjM/QN

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\94AC42~1.EXE,"	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\94AC42~1.EXE"	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\e45c5186 = "NÏ1d~Ä¼îÕˆxP_iûý\x1e\r\x01\a(W¡bÆô(¹˜Òó7•\x0eúìËB¥9é\x03K•Q\"a˜]p‚ù\u00adzÍ¸\u00a0Œ>ùXÏUŽÄ]\a\u00ad˜¡Þ ˆw€,\u0090\a¨ª\u00ad™R:\x14\x10Vå¾ƒ\u0090ÍÔ!\u0090Ø\v\x01ÅPd\x11pP\x14œÉ¯ÈmÏÙI¯\x0e\x11f¾ß~IVyuDmÌå\u00adæu\|™}x˜\x16\x15q\x18þ½\x1e}Tõ1à¾ NAà\x16\x11\rö\x19Q¶=\r—ŽyO×\f}fpli™øù\tU™Èg\t¡=-ôôeÁÉ\x11•¦\u008f$ýa\x1c¤(¿Ô9\u009d¸Õ\tœ5Îá)™\x06„ÈÁIÉ\x18VüÆ7\x10üQ©¤]94Í%½¡}Í‘Im\x1881_Ôµg_!¹Æ…T„™¶H"	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\94AC42~1.EXE"	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1932	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
1932	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
1932	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
1932	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
1932	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
1932	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
1932	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1932	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
Token: SeSecurityPrivilege	1932	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
Token: SeSecurityPrivilege	1932	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
Token: SeSecurityPrivilege	1932	94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe

C:\Users\Admin\AppData\Local\Temp\94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe
"C:\Users\Admin\AppData\Local\Temp\94ac429f250aff90e6e975aa12d892311a815c11bdc6c950e45299360d5de80a.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1932-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/1932-55-0x0000000010000000-0x000000001004C000-memory.dmp

Filesize
304KB

Download
memory/1932-57-0x00000000022F0000-0x00000000023AE000-memory.dmp

Filesize
760KB

Download
memory/1932-56-0x00000000022F0000-0x00000000023AE000-memory.dmp

Filesize
760KB

Download
memory/1932-58-0x00000000022F0000-0x00000000023AE000-memory.dmp

Filesize
760KB

Download
memory/1932-60-0x00000000022F0000-0x00000000023AE000-memory.dmp

Filesize
760KB

Download
memory/1932-61-0x00000000022F0000-0x00000000023AE000-memory.dmp

Filesize
760KB

Download
memory/1932-63-0x00000000022F0000-0x00000000023AE000-memory.dmp

Filesize
760KB

Download
memory/1932-64-0x0000000002530000-0x00000000025F5000-memory.dmp

Filesize
788KB

Download