fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537

General

Target

fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
Size

288KB
MD5

70955c6d019b1861e0e5011f82ed5ded
SHA1

5265345b4354416d311003e27ffe52e385efc022
SHA256

fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537
SHA512

b2633d8c3d2aaeca63ba4960541e82a96ad96d12614690173278a1869e653d328f24d62e81d5c63639928802b88add2d5cce4cdfe9d9c80f1a4e80cd229bca1d
SSDEEP

6144:Zlr6yDU7fqP/f0LETIOfrlYc5gTTArVR32GOuMMTrzuWeR7PP7EEPMW:9DqyXcLdWrll5gTT82ITrzpoPjR

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\FA5220~1.EXE,"	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FA5220~1.EXE"	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FA5220~1.EXE"	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\d346bfb9 = "\x1fL\b\a-3ì% o¸Á{š\"'nLás’\x1f§\u0090¹omØVˆ\x13ckâ‹\x0f>ôdôIoÜ?}`öA~>!‘r/.²\a\x0e8\x01‚—\x01Q$.üBcpd4•H—Ç÷¥%\"ôT\u0090Â«5gþ\u008f\\e£\x04JûO˜\|\x13ŸŽÐê\fô~cÍ†þb¾žÜíƒk\x06jÝ\x0eDõ&\r\x1abÌµ4D®5ôt$<6”eLd$\x0e¤¶Ã«¦V^ä”Ã\x1dT¤îs2\x1cf\nL\x1eœ\x15E„Îûæ,\fV\x06”ýC;š•ô{\x0eÛ\x06Žîjn^šN²\fä\u009d\x14Œ\x06þjn\x16ü.õŽ\x1es’k]J\x1eT.¬\x02ö&^v^N\x03f\x16Ì\x06“BfcþµÆÜì:š2Þ\x06$$Vv&+d$NŽj¶¼6V"	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1472	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
1472	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
1472	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
1472	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
1472	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
1472	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
1472	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1472	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
Token: SeSecurityPrivilege	1472	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
Token: SeSecurityPrivilege	1472	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
Token: SeSecurityPrivilege	1472	fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe

C:\Users\Admin\AppData\Local\Temp\fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe
"C:\Users\Admin\AppData\Local\Temp\fa5220ec2ccd87e2c3d104354b0ae7b0ad12193f2ae1a00b5def323b35665537.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-54-0x0000000075F21000-0x0000000075F23000-memory.dmp

Filesize
8KB

Download
memory/1472-55-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/1472-56-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1472-57-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/1472-58-0x0000000000400000-0x000000000044B000-memory.dmp

Filesize
300KB

Download
memory/1472-59-0x00000000023E0000-0x0000000002492000-memory.dmp

Filesize
712KB

Download
memory/1472-60-0x00000000023E0000-0x0000000002492000-memory.dmp

Filesize
712KB

Download
memory/1472-61-0x00000000023E0000-0x0000000002492000-memory.dmp

Filesize
712KB

Download
memory/1472-63-0x00000000023E0000-0x0000000002492000-memory.dmp

Filesize
712KB

Download
memory/1472-64-0x00000000023E0000-0x0000000002492000-memory.dmp

Filesize
712KB

Download
memory/1472-66-0x00000000023E0000-0x0000000002492000-memory.dmp

Filesize
712KB

Download
memory/1472-67-0x00000000025A0000-0x0000000002658000-memory.dmp

Filesize
736KB

Download
memory/1472-68-0x00000000025A0000-0x0000000002658000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads