a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d

General

Target

a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
Size

243KB
MD5

89494dd18ee3baa8be880bbe6c577986
SHA1

e1e745f4432c59718befc58a021b2fb0eb296b24
SHA256

a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d
SHA512

7d59066c00c9b6032a4ea3e51a102248e0943a35080f3761c74a63dcbfad0dc54d845eebb0eb67c2c956ef1e676d5535c1dcf07374e356fa230779ca9e5e6467
SSDEEP

6144:gvoMvtQYA99LIxGtp7gZQ+4CcxYc/ZwyUiYQw4dAN9inWTY+otHbyYuZkqQm:gvoMvtQYA9KxGtGW2cBRUmd8onWM+2kH

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\A708FE~1.EXE,"	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A708FE~1.EXE"	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ab70b25 = "\x10Ðã‚…~'‚—y±ùs‹T¿±”F\x11o(ÜÿÄÄÙhO\tdP”¼&Ì\u0081~uVÍñ'îq£Ÿnz\u0090ôñE»sy\x04¦à\u008dz\x03&ôç¸-àa‚{õœ/!1M¥Ïº\x1fÕl´+q\u009dL\u0090ùuCÇBTù%:¡aÉþûÓäª%B\x16\b=ûCñÑn’{¿\x16n‰\x17£”É(¿ÉÉ\va\x7f!t”\x02vÉ.8ÎC\x11!NþtÁªù€JB\x1d\x16É‰PÞ”¥ð”\x7f\\Ëð®\x16.Ë\x04:\u00ad7^\u00ad”p'§ú‰±Wª\x7f\x1d%°v\x04\u00ado(%òª\v%±üj=Î\\8\x1aoØÕ5\x7ffK’ÀSð5\\±\u008f\bØØ{\u0081‰õ\u008dÕo’Ï\bLÀ\vå(ë¿Î\x16±¾yy\u008d}Ày†ØC\\”\x1f"	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A708FE~1.EXE"	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
Token: SeSecurityPrivilege	956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
Token: SeSecurityPrivilege	956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
Token: SeSecurityPrivilege	956	a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe

C:\Users\Admin\AppData\Local\Temp\a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe
"C:\Users\Admin\AppData\Local\Temp\a708fe79569c40174ce213bf729ec45bafc155e42abd4d8992a60530f362276d.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/956-54-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/956-55-0x0000000000350000-0x00000000003B7000-memory.dmp

Filesize
412KB

Download
memory/956-56-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/956-57-0x0000000000400000-0x000000000051F000-memory.dmp

Filesize
1.1MB

Download
memory/956-59-0x0000000002140000-0x00000000021F2000-memory.dmp

Filesize
712KB

Download
memory/956-58-0x0000000002140000-0x00000000021F2000-memory.dmp

Filesize
712KB

Download
memory/956-62-0x0000000002140000-0x00000000021F2000-memory.dmp

Filesize
712KB

Download
memory/956-60-0x0000000002140000-0x00000000021F2000-memory.dmp

Filesize
712KB

Download
memory/956-63-0x0000000002140000-0x00000000021F2000-memory.dmp

Filesize
712KB

Download
memory/956-65-0x0000000002140000-0x00000000021F2000-memory.dmp

Filesize
712KB

Download
memory/956-66-0x0000000002740000-0x00000000027F8000-memory.dmp

Filesize
736KB

Download
memory/956-67-0x0000000000350000-0x00000000003B7000-memory.dmp

Filesize
412KB

Download
memory/956-68-0x0000000002740000-0x00000000027F8000-memory.dmp

Filesize
736KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads