d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf

General

Target

d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
Size

257KB
MD5

1c1a9cd82a8e256c75011aca7c398a13
SHA1

059e7a95a2dee3eda18e6118dd0e34b749f5b821
SHA256

d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf
SHA512

d40beb698e5770678bc15d2c75a8cdfc72705f18669eaf35e92e92c771b39d7d84905d87e5cde5dccc9feabce25e40294089918418368cb3234067429ec86ba5
SSDEEP

6144:WYVe9FeDjJ54UypCaexr6D7XOYEVsxVC0RPXbFib:WYVekNYHsi+5VsxFJXZib

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\D24870~1.EXE,"	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D24870~1.EXE"	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\b2d9b37c = "M\x19\x1a\x16U¯D‰½ÇúK\rXR0F\x02¥ïnŸ.¾+\u00ad(\x1e¾w¬‡Œ=\x1a\\¢†9\x16Œyaï<wF\f\fI€\x17;\x13aQuÉÁãP@ÆžyÔ-\x14Ú„”\x03t=x\x0f\x06AÛE8\u008f•DSGïW\u0081o\x0e’\x06\x1f\x10EäŒ\u00a0gÎÞîú6L¼nzNö\x1e[ÒŽV¦Ü9ò\x02*ì¾1k\x0ec6ÚJC^&C†ª\x06\x11Š>Üf’\x02ú\x16Nœ¾Éfê†\x02þ–üª¹\nz\x19vþRzN£lìF†ñ\x1e\x06~Öv\x04’\\†n\x14¦\x02ü\"rR\x02SI®SËd‹‰ª»ºFKö‘Ö<Ž™Þò\tl’»òN~†Ìnûî¾\nfäŽš:R<f,vž¾i‹®c\u0081~Q’¹ñcVzD±îóãJ¦š"	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D24870~1.EXE"	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
Token: SeSecurityPrivilege	1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
Token: SeSecurityPrivilege	1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
Token: SeSecurityPrivilege	1468	d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe

C:\Users\Admin\AppData\Local\Temp\d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe
"C:\Users\Admin\AppData\Local\Temp\d2487003c96e86b3c5187c65356f485e320bb969b50e99b97b1a33794d8a26bf.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1468

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download
memory/1468-55-0x00000000002B0000-0x0000000000309000-memory.dmp

Filesize
356KB

Download
memory/1468-56-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/1468-58-0x0000000002150000-0x0000000002202000-memory.dmp

Filesize
712KB

Download
memory/1468-57-0x0000000002150000-0x0000000002202000-memory.dmp

Filesize
712KB

Download
memory/1468-59-0x0000000002150000-0x0000000002202000-memory.dmp

Filesize
712KB

Download
memory/1468-62-0x0000000002150000-0x0000000002202000-memory.dmp

Filesize
712KB

Download
memory/1468-61-0x0000000002150000-0x0000000002202000-memory.dmp

Filesize
712KB

Download
memory/1468-64-0x0000000002150000-0x0000000002202000-memory.dmp

Filesize
712KB

Download
memory/1468-65-0x0000000002620000-0x00000000026D8000-memory.dmp

Filesize
736KB

Download
memory/1468-66-0x00000000002B0000-0x0000000000309000-memory.dmp

Filesize
356KB

Download
memory/1468-67-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download
memory/1468-68-0x0000000002620000-0x00000000026D8000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads