Analysis
-
max time kernel
163s -
max time network
200s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 14:29
Static task
static1
Behavioral task
behavioral1
Sample
b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe
-
Size
280KB
-
MD5
f320f00d07083fde93f76cfc0b0ce304
-
SHA1
75101b06fec6f5414a4b1b1adfa32528919ef879
-
SHA256
b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3
-
SHA512
690e13e03c17b0736d5300ca4ae13e2b240355fdd58784180aa5f028ae839b1b72c2700f67f2b2819cc0d48b775e298675d6b979258975dda232053c29f9e4f7
-
SSDEEP
6144:Hv8Kp+fj7SObQm/PEVwLP0pNa7hTr2SbY912/b1cAUlEL:HEKKLQm/s48pNgprVbY9Ebms
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\B97DB7~1.EXE," b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\B97DB7~1.EXE" b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\db1053c2 = "–váœÈ^DÐ\x11P`3r2§¬´C_Çß½ÍqÒOôXÿ¯ž\x1b´õû\\¬]Oñ0¡{×uïR§žIÓ`ùè\u008fHX1õËß\u008d_5\x149\u00a0\"\x1er%àùAóºj¥0\x14åÊ\rfp\u00a0Öœ¹!nâüø@›Q\x12£¼S\x0e>»Ã¾D„>%¦»\x11…Õ±=Ó\x1d+Œ™}‘Ä\x16Œ\x1cì\x04\x1e¥%µ©\x19\x03ÃÙ\x14£y\f»\\\x19Sóì©Õ™&<\x15{\u008d¬™”!¥\u00ad[®å\x05‰–&Ñ%£í5k~¬\t\x1b3\x05[Ý%+\x03)-½ŽÜ•±œÙËó\x01Ci‘룳Ã[\x1dmAÜC\r\ve\\k•¦¾Ô}\x19\x03œä\\[Ŭ«m\x15ã•Ó™\x01k<ó\\\x03QõSíûƦcL\x03\u009dÍm»Uuu" b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\B97DB7~1.EXE" b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSecurityPrivilege 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe Token: SeSecurityPrivilege 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe Token: SeSecurityPrivilege 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe Token: SeSecurityPrivilege 1660 b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe"C:\Users\Admin\AppData\Local\Temp\b97db7186a83cb2b0eb64feb6fb64f1ee1598c4d67a651f765ccee44ca9cd7b3.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660