Analysis
-
max time kernel
170s -
max time network
111s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 11:57
Static task
static1
Behavioral task
behavioral1
Sample
a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe
-
Size
56KB
-
MD5
4f658b2c3613fdc08090180f22036f8d
-
SHA1
95f17de7a5da3897ed8e15e4793bb004e19702eb
-
SHA256
a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a
-
SHA512
6200c904d142809e31a2857503475bf1b8b7bca3eb6f758bc8d98cd34fffb0a3c65905949a0a0cdcd0a57176863545c2b6425240ee130dd164c8c560bfc1f50d
-
SSDEEP
768:NNBSEzbPYWDLxE8h9NbgWdFqtuP6AD9RFV/9V/yEq5r9MQWAii1E:TBSEzDI8h9Nbg8FDD2WABC
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1528 winlogon.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\winlogon.exe" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\winlogon.exe" winlogon.exe -
Drops autorun.inf file 1 TTPs 26 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\P:\autorun.inf winlogon.exe File opened for modification \??\R:\autorun.inf winlogon.exe File opened for modification \??\S:\autorun.inf winlogon.exe File opened for modification C:\autorun.inf winlogon.exe File opened for modification D:\autorun.inf winlogon.exe File opened for modification \??\E:\autorun.inf winlogon.exe File opened for modification \??\L:\autorun.inf winlogon.exe File opened for modification \??\W:\autorun.inf winlogon.exe File opened for modification \??\H:\autorun.inf winlogon.exe File opened for modification \??\I:\autorun.inf winlogon.exe File opened for modification \??\M:\autorun.inf winlogon.exe File opened for modification \??\U:\autorun.inf winlogon.exe File opened for modification \??\K:\autorun.inf winlogon.exe File opened for modification \??\N:\autorun.inf winlogon.exe File opened for modification \??\O:\autorun.inf winlogon.exe File opened for modification \??\Q:\autorun.inf winlogon.exe File opened for modification \??\A:\autorun.inf winlogon.exe File opened for modification \??\B:\autorun.inf winlogon.exe File opened for modification \??\F:\autorun.inf winlogon.exe File opened for modification \??\G:\autorun.inf winlogon.exe File opened for modification \??\V:\autorun.inf winlogon.exe File opened for modification \??\Z:\autorun.inf winlogon.exe File opened for modification \??\J:\autorun.inf winlogon.exe File opened for modification \??\T:\autorun.inf winlogon.exe File opened for modification \??\X:\autorun.inf winlogon.exe File opened for modification \??\Y:\autorun.inf winlogon.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\winlogon.exe winlogon.exe File opened for modification C:\Windows\winlogon.exe winlogon.exe File created C:\Windows\winlogon.exe a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe File opened for modification C:\Windows\winlogon.exe a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main winlogon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1300 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 1300 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 1300 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 1300 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe 1528 winlogon.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1300 wrote to memory of 1528 1300 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 28 PID 1300 wrote to memory of 1528 1300 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 28 PID 1300 wrote to memory of 1528 1300 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 28 PID 1300 wrote to memory of 1528 1300 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe"C:\Users\Admin\AppData\Local\Temp\a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\winlogon.exeC:\Windows\winlogon.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1528
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD54f658b2c3613fdc08090180f22036f8d
SHA195f17de7a5da3897ed8e15e4793bb004e19702eb
SHA256a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a
SHA5126200c904d142809e31a2857503475bf1b8b7bca3eb6f758bc8d98cd34fffb0a3c65905949a0a0cdcd0a57176863545c2b6425240ee130dd164c8c560bfc1f50d
-
Filesize
56KB
MD54f658b2c3613fdc08090180f22036f8d
SHA195f17de7a5da3897ed8e15e4793bb004e19702eb
SHA256a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a
SHA5126200c904d142809e31a2857503475bf1b8b7bca3eb6f758bc8d98cd34fffb0a3c65905949a0a0cdcd0a57176863545c2b6425240ee130dd164c8c560bfc1f50d