8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f

General

Target

8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
Size

335KB
MD5

78cd7b4cdbbe05b6a1c9e1f132bced25
SHA1

5d2d79f3052e8ca5ce766addd4874cc25d06b356
SHA256

8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f
SHA512

ce739800cbe0e1fa6d65156016e128a195f6ab978f2450fbc8ccb8a3e88de45d7750e9739492a0f753626ffdfa7732a60d99fcf7007b10bae79e36195eedf948
SSDEEP

6144:rDTkT+bYTdPpcjNE4IitaE5XGUSa2Ux4S+RFWKvk6f:gT5TDc64IitaF5arik

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\8DB2E5~1.EXE,"	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8DB2E5~1.EXE"	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\a2887d0b = "MAos(„PÁ\x12‚ç\x03B7ÞK^û×wW\u00a0þ\x1f\|þø7\x19Oü¦~ÑKÇ¹)œ\x1bšßoÛ2J\az\|'ùGGNÂ\t_õ¸6+£\x17\u00adbÅ70¼êß\x10è¡‘‚°\x0f\x7fñ\x05RêËA\u00a0TéÖ¿çøÂžÛ¨\u00a0t{Ì‰3æ{£žù;E\x15-Žé-–\t©MyÙr¦áûZŠk2\"ó!3QsY>±\v[ÙEÖ[ÉAQ%YS[iÉ³Îmó¥J\x01!S\x0ekÙ\t\x0eáerÊÙ“‹#\x01f½[sB›}’Ëf›ó]\u0081ªimþ¡óãE[\x16S!Á&šcã9©\x11#“én;2¹Q¹\x11µ=A-‘Þ+\x13i‘]Æ\vNS\x02aÍS%áÃÃZ1#~F±ÁUý\x15Ã+{k‹r"	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8DB2E5~1.EXE"	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
784	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
784	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
784	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
784	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
784	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
784	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
784	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	784	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
Token: SeSecurityPrivilege	784	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
Token: SeSecurityPrivilege	784	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
Token: SeSecurityPrivilege	784	8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe

C:\Users\Admin\AppData\Local\Temp\8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe
"C:\Users\Admin\AppData\Local\Temp\8db2e5399faacd3e93d2de4d1f35a1dfcc1320ba307acdf0da9f7c905dfa040f.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-54-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/784-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/784-56-0x0000000000400000-0x0000000000634000-memory.dmp

Filesize
2.2MB

Download
memory/784-57-0x0000000002100000-0x00000000021B2000-memory.dmp

Filesize
712KB

Download
memory/784-58-0x0000000002100000-0x00000000021B2000-memory.dmp

Filesize
712KB

Download
memory/784-59-0x0000000002100000-0x00000000021B2000-memory.dmp

Filesize
712KB

Download
memory/784-61-0x0000000002100000-0x00000000021B2000-memory.dmp

Filesize
712KB

Download
memory/784-62-0x0000000002100000-0x00000000021B2000-memory.dmp

Filesize
712KB

Download
memory/784-64-0x0000000002100000-0x00000000021B2000-memory.dmp

Filesize
712KB

Download
memory/784-65-0x0000000002670000-0x0000000002728000-memory.dmp

Filesize
736KB

Download
memory/784-66-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/784-67-0x0000000000400000-0x0000000000634000-memory.dmp

Filesize
2.2MB

Download
memory/784-68-0x0000000002670000-0x0000000002728000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads