Analysis
-
max time kernel
192s -
max time network
205s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 11:57
Static task
static1
Behavioral task
behavioral1
Sample
a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe
-
Size
56KB
-
MD5
4f658b2c3613fdc08090180f22036f8d
-
SHA1
95f17de7a5da3897ed8e15e4793bb004e19702eb
-
SHA256
a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a
-
SHA512
6200c904d142809e31a2857503475bf1b8b7bca3eb6f758bc8d98cd34fffb0a3c65905949a0a0cdcd0a57176863545c2b6425240ee130dd164c8c560bfc1f50d
-
SSDEEP
768:NNBSEzbPYWDLxE8h9NbgWdFqtuP6AD9RFV/9V/yEq5r9MQWAii1E:TBSEzDI8h9Nbg8FDD2WABC
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 816 winlogon.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\winlogon.exe" winlogon.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Windows\CurrentVersion\Run winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Windows\\winlogon.exe" winlogon.exe -
Drops autorun.inf file 1 TTPs 26 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification \??\M:\autorun.inf winlogon.exe File opened for modification \??\P:\autorun.inf winlogon.exe File opened for modification \??\R:\autorun.inf winlogon.exe File opened for modification \??\U:\autorun.inf winlogon.exe File opened for modification \??\V:\autorun.inf winlogon.exe File opened for modification \??\Z:\autorun.inf winlogon.exe File opened for modification \??\B:\autorun.inf winlogon.exe File opened for modification \??\H:\autorun.inf winlogon.exe File opened for modification \??\E:\autorun.inf winlogon.exe File opened for modification \??\G:\autorun.inf winlogon.exe File opened for modification \??\J:\autorun.inf winlogon.exe File opened for modification \??\K:\autorun.inf winlogon.exe File opened for modification \??\S:\autorun.inf winlogon.exe File opened for modification \??\Y:\autorun.inf winlogon.exe File opened for modification \??\A:\autorun.inf winlogon.exe File opened for modification C:\autorun.inf winlogon.exe File opened for modification \??\O:\autorun.inf winlogon.exe File opened for modification \??\W:\autorun.inf winlogon.exe File opened for modification \??\X:\autorun.inf winlogon.exe File opened for modification \??\L:\autorun.inf winlogon.exe File opened for modification \??\N:\autorun.inf winlogon.exe File opened for modification \??\I:\autorun.inf winlogon.exe File opened for modification \??\Q:\autorun.inf winlogon.exe File opened for modification \??\T:\autorun.inf winlogon.exe File opened for modification D:\autorun.inf winlogon.exe File opened for modification \??\F:\autorun.inf winlogon.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\winlogon.exe a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe File opened for modification C:\Windows\winlogon.exe a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe File created C:\Windows\winlogon.exe winlogon.exe File opened for modification C:\Windows\winlogon.exe winlogon.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1152 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 1152 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 1152 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 1152 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe 816 winlogon.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1152 wrote to memory of 816 1152 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 83 PID 1152 wrote to memory of 816 1152 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 83 PID 1152 wrote to memory of 816 1152 a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe"C:\Users\Admin\AppData\Local\Temp\a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a.exe"1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\winlogon.exeC:\Windows\winlogon.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:816
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD54f658b2c3613fdc08090180f22036f8d
SHA195f17de7a5da3897ed8e15e4793bb004e19702eb
SHA256a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a
SHA5126200c904d142809e31a2857503475bf1b8b7bca3eb6f758bc8d98cd34fffb0a3c65905949a0a0cdcd0a57176863545c2b6425240ee130dd164c8c560bfc1f50d
-
Filesize
56KB
MD54f658b2c3613fdc08090180f22036f8d
SHA195f17de7a5da3897ed8e15e4793bb004e19702eb
SHA256a9d66ec3f1b91aace48cc5f35287f3d4c88a13b57481099b56a209af269cd75a
SHA5126200c904d142809e31a2857503475bf1b8b7bca3eb6f758bc8d98cd34fffb0a3c65905949a0a0cdcd0a57176863545c2b6425240ee130dd164c8c560bfc1f50d