f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf

Analysis

max time kernel
183s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 09:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf.exe
Size

17KB
MD5

1ba2a4612638dbf4cca048cc6ec94000
SHA1

1bc8e6872ab938734cabc74ce0653c5de649f2a7
SHA256

f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf
SHA512

cf8485503dbbc1c8485c4a4814529109530131ae503faa178d7f7b7bf6564fdbf847d7306dc26148e2c6c6ff3e7797efffae2b14192d0fbc90d081d4603a82a3
SSDEEP

192:Hm5PmYTqpvt8nFaRsYzGWuvkAVrmF608A47iDEjGf7Lz:G5PmYT6vOwRdvUI6dr7W4Gfz

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\Tasks\\conime.exe"	f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf.exe

Executes dropped EXE 1 IoCs

pid	Process
3488	conime.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\conime.exe	f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf.exe
File opened for modification	C:\Windows\Tasks\conime.exe	f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3752	f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 3488	3752	f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf.exe	84
PID 3752 wrote to memory of 3488	3752	f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf.exe	84
PID 3752 wrote to memory of 3488	3752	f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf.exe	84

C:\Users\Admin\AppData\Local\Temp\f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf.exe
"C:\Users\Admin\AppData\Local\Temp\f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Windows\Tasks\conime.exe
  C:\Windows\Tasks\conime.exe
  2⤵
  - Executes dropped EXE
  PID:3488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Tasks\conime.exe

Filesize
17KB

MD5
1ba2a4612638dbf4cca048cc6ec94000

SHA1
1bc8e6872ab938734cabc74ce0653c5de649f2a7

SHA256
f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf

SHA512
cf8485503dbbc1c8485c4a4814529109530131ae503faa178d7f7b7bf6564fdbf847d7306dc26148e2c6c6ff3e7797efffae2b14192d0fbc90d081d4603a82a3

Download Submit
C:\Windows\Tasks\conime.exe

Filesize
17KB

MD5
1ba2a4612638dbf4cca048cc6ec94000

SHA1
1bc8e6872ab938734cabc74ce0653c5de649f2a7

SHA256
f42213d43922a732779728045d10179fa4c979c6b2777006674f41fb7d9fa8bf

SHA512
cf8485503dbbc1c8485c4a4814529109530131ae503faa178d7f7b7bf6564fdbf847d7306dc26148e2c6c6ff3e7797efffae2b14192d0fbc90d081d4603a82a3

Download Submit