9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4

Analysis

max time kernel
227s
max time network
307s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe
Size

250KB
MD5

4e3551a05ae8766630458c952578d677
SHA1

ad45e73b9139c293d2616a3293809c6e8072baca
SHA256

9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4
SHA512

22a461df0d4e030ba36c3e6c0cc652da4c09018e3a0af5e17dd2a0d37bb71e8f293d1faee5083ef49fd4e0329089a47e33f097e28102c154a6472e606f10876c
SSDEEP

3072:MGOFLomQsQtM25LSF12LT8nsQqIbSC3IzSNGOsDGLCpIfMhlGV6T3A/tROoHniXb:KXxQtJ2FSBYr3gOrEhdT3A/tROoHLQ

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\9F4585~1.EXE,"	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9F4585~1.EXE"	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\ef325819 = "¾%Ùd\nÂœª5Ä=d\x18‹u¦½I1h-`©ëÀ2\x18\x05íóŒzmM"	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
620	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe
620	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe
620	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe
620	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe
620	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	620	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe
Token: SeSecurityPrivilege	620	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe
Token: SeSecurityPrivilege	620	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe
Token: SeSecurityPrivilege	620	9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe

C:\Users\Admin\AppData\Local\Temp\9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe
"C:\Users\Admin\AppData\Local\Temp\9f458556607cf619db63f7147e9b46ea132cd542baef6e9a88b012adf0d822e4.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/620-54-0x00000000763D1000-0x00000000763D3000-memory.dmp

Filesize
8KB

Download
memory/620-55-0x00000000004A0000-0x0000000000500000-memory.dmp

Filesize
384KB

Download
memory/620-56-0x0000000000400000-0x000000000049F000-memory.dmp

Filesize
636KB

Download
memory/620-57-0x00000000004A0000-0x0000000000500000-memory.dmp

Filesize
384KB

Download
memory/620-58-0x0000000002800000-0x00000000028B2000-memory.dmp

Filesize
712KB

Download
memory/620-59-0x0000000002800000-0x00000000028B2000-memory.dmp

Filesize
712KB

Download
memory/620-60-0x0000000002800000-0x00000000028B2000-memory.dmp

Filesize
712KB

Download
memory/620-62-0x0000000002800000-0x00000000028B2000-memory.dmp

Filesize
712KB

Download
memory/620-63-0x0000000002800000-0x00000000028B2000-memory.dmp

Filesize
712KB

Download
memory/620-65-0x0000000002800000-0x00000000028B2000-memory.dmp

Filesize
712KB

Download
memory/620-66-0x0000000002A00000-0x0000000002AB8000-memory.dmp

Filesize
736KB

Download
memory/620-67-0x0000000002A00000-0x0000000002AB8000-memory.dmp

Filesize
736KB

Download