Analysis

  • max time kernel
    152s
  • max time network
    195s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 02:34

General

  • Target

    fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe

  • Size

    288KB

  • MD5

    70955c6d019b1861e0e5011f82ed5ded

  • SHA1

    5265345b4354416d311003e27ffe52e385efc022

  • SHA256

    fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537

  • SHA512

    b2633d8c3d2aaeca63ba4960541e82a96ad96d12614690173278a1869e653d328f24d62e81d5c63639928802b88add2d5cce4cdfe9d9c80f1a4e80cd229bca1d

  • SSDEEP

    6144:Zlr6yDU7fqP/f0LETIOfrlYc5gTTArVR32GOuMMTrzuWeR7PP7EEPMW:9DqyXcLdWrll5gTT82ITrzpoPjR

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
    "C:\Users\Admin\AppData\Local\Temp\fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1472

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1472-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

    Filesize

    8KB

  • memory/1472-55-0x000000007EF40000-0x000000007EFA9000-memory.dmp

    Filesize

    420KB

  • memory/1472-56-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1472-57-0x000000007EF40000-0x000000007EFA9000-memory.dmp

    Filesize

    420KB

  • memory/1472-58-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1472-59-0x00000000023E0000-0x0000000002492000-memory.dmp

    Filesize

    712KB

  • memory/1472-60-0x00000000023E0000-0x0000000002492000-memory.dmp

    Filesize

    712KB

  • memory/1472-61-0x00000000023E0000-0x0000000002492000-memory.dmp

    Filesize

    712KB

  • memory/1472-63-0x00000000023E0000-0x0000000002492000-memory.dmp

    Filesize

    712KB

  • memory/1472-64-0x00000000023E0000-0x0000000002492000-memory.dmp

    Filesize

    712KB

  • memory/1472-66-0x00000000023E0000-0x0000000002492000-memory.dmp

    Filesize

    712KB

  • memory/1472-67-0x00000000025A0000-0x0000000002658000-memory.dmp

    Filesize

    736KB

  • memory/1472-68-0x00000000025A0000-0x0000000002658000-memory.dmp

    Filesize

    736KB