Analysis
-
max time kernel
152s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 12:05
Static task
static1
Behavioral task
behavioral1
Sample
de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe
-
Size
252KB
-
MD5
3381a8362587384e210c87989baf1c63
-
SHA1
7629ab5fb235793248f5574d81f0e0f53113dd4d
-
SHA256
de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856
-
SHA512
905f0b211370f604d9c9c5b6844c68dd4a4c9b151482201afbf1241ee4941f887afe0bb4642d429ac03f6f3df0459fe41d86fe9a67c2cad23b5c79732fbf49fd
-
SSDEEP
6144:E1rwii7st1Y+S6pYQCR+gs74dVGwG+oISthMZzLkV:ET+sH4wgsLMFkV
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\DE5657~1.EXE," de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DE5657~1.EXE" de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\b17d263e = "öÐiívÀŠyÿ\x7fÊwläNßÅ£ôæ³®òFlÑiƒ\x13ù\u00adðkVª“Þ\x1b'yß{\x17\x11x%OiªSvç\f\x0f\f³\x182;‰gå%\u00adÛ\tºƒDÖSa,¢\x1dÃiûÚ\x06k{I\x18œN\u00a0\bä廨«Pá’PkaÀ…Ø‚µ\x03ÞµCg›\x03’u\x05ØõB*2M˜*ý'o\x1aCŠ\x06\x1f\x02о“~à\x1d/µ-\"\x15Ò=•ZåÖö›Ê2È\x10k:{²Z\u008d:Ã\x0e2ýõ«Ó6@RæM‚¢MÅâ\n%Ðk\x1avêÛ~n\v\x06Š=Bµ¨â\x06\u008f’S\aÒ\"ªE\x10n\x0f;h°÷RõÊjÍþ2E*\r\x7f\x05ÛÆ\x12ú®Ê¢Å" de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\DE5657~1.EXE" de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe Token: SeSecurityPrivilege 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe Token: SeSecurityPrivilege 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe Token: SeSecurityPrivilege 1020 de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe"C:\Users\Admin\AppData\Local\Temp\de56575a24381395ca9bb074e7830fdd0a64f368caa0200eab60b3de1266d856.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020