8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3

Analysis

max time kernel
187s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe
Size

485KB
MD5

8ec2ba2a9e37ffd8128070c44f672cf8
SHA1

2aecba93cab7ec1f2cc87a5bf4f981c92d0f3a26
SHA256

8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3
SHA512

d7d4876a6e1d09cc7e63b876e9f0f41023c9db113c4bd033aa7a944302cc9fecd89a842dba028bb70ea57766fc8661c122ce12be5365f357bfef92e69549e81f
SSDEEP

12288:vOemhBycp3h7q3A2aAJD+ERBq0QgxTlEmhOB/uy:xEd3h7qb82qaTSAOBWy

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\sdra64.exe,"	assist.exe

Executes dropped EXE 1 IoCs

pid	Process
4272	assist.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sdra64.exe	assist.exe
File opened for modification	C:\Windows\SysWOW64\sdra64.exe	assist.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4548 set thread context of 988	4548	8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe	79

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4272	assist.exe
4272	assist.exe
4272	assist.exe
4272	assist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	assist.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 988	4548	8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe	79
PID 4548 wrote to memory of 988	4548	8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe	79
PID 4548 wrote to memory of 988	4548	8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe	79
PID 4548 wrote to memory of 988	4548	8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe	79
PID 4548 wrote to memory of 988	4548	8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe	79
PID 988 wrote to memory of 4272	988	8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe	80
PID 988 wrote to memory of 4272	988	8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe	80
PID 988 wrote to memory of 4272	988	8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe	80
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5
PID 4272 wrote to memory of 604	4272	assist.exe	5

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:604

C:\Users\Admin\AppData\Local\Temp\8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe
"C:\Users\Admin\AppData\Local\Temp\8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Users\Admin\AppData\Local\Temp\8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe
  C:\Users\Admin\AppData\Local\Temp\8f121f1ae98e58717f9dce8b4f04cff1695a9de4ce4d3f76f413189293488da3.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Users\Admin\AppData\Local\Temp\assist.exe
    "C:\Users\Admin\AppData\Local\Temp\assist.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\assist.exe

Filesize
62KB

MD5
e980b53d881d4df55c8c761495bc1e26

SHA1
21ce8871f052defb1decb5d343340b67cfa1413d

SHA256
7ffd54bbdc85ad82f77cc39c9003b0438ef0db5b219b7073a6100d35df4cdaf6

SHA512
18532b81be7394fc43e52efb8b5512d5e3aa867e6958e23a98b2759e4097f4a179098115e3fef714933742f684a8b0634ab9fc5904ea1d1e1997e227e5a2ce06

Download Submit
C:\Users\Admin\AppData\Local\Temp\assist.exe

Filesize
62KB

MD5
e980b53d881d4df55c8c761495bc1e26

SHA1
21ce8871f052defb1decb5d343340b67cfa1413d

SHA256
7ffd54bbdc85ad82f77cc39c9003b0438ef0db5b219b7073a6100d35df4cdaf6

SHA512
18532b81be7394fc43e52efb8b5512d5e3aa867e6958e23a98b2759e4097f4a179098115e3fef714933742f684a8b0634ab9fc5904ea1d1e1997e227e5a2ce06

Download Submit
memory/604-200-0x0000000034220000-0x0000000034237000-memory.dmp

Filesize
92KB

Download
memory/604-150-0x00000000340E0000-0x00000000340F7000-memory.dmp

Filesize
92KB

Download
memory/604-235-0x0000000034300000-0x0000000034317000-memory.dmp

Filesize
92KB

Download
memory/604-230-0x00000000342E0000-0x00000000342F7000-memory.dmp

Filesize
92KB

Download
memory/604-225-0x00000000342C0000-0x00000000342D7000-memory.dmp

Filesize
92KB

Download
memory/604-220-0x00000000342A0000-0x00000000342B7000-memory.dmp

Filesize
92KB

Download
memory/604-175-0x0000000034180000-0x0000000034197000-memory.dmp

Filesize
92KB

Download
memory/604-155-0x0000000034100000-0x0000000034117000-memory.dmp

Filesize
92KB

Download
memory/604-160-0x0000000034120000-0x0000000034137000-memory.dmp

Filesize
92KB

Download
memory/604-165-0x0000000034140000-0x0000000034157000-memory.dmp

Filesize
92KB

Download
memory/604-215-0x0000000034280000-0x0000000034297000-memory.dmp

Filesize
92KB

Download
memory/604-170-0x0000000034160000-0x0000000034177000-memory.dmp

Filesize
92KB

Download
memory/604-210-0x0000000034260000-0x0000000034277000-memory.dmp

Filesize
92KB

Download
memory/604-185-0x00000000341C0000-0x00000000341D7000-memory.dmp

Filesize
92KB

Download
memory/604-190-0x00000000341E0000-0x00000000341F7000-memory.dmp

Filesize
92KB

Download
memory/604-195-0x0000000034200000-0x0000000034217000-memory.dmp

Filesize
92KB

Download
memory/604-180-0x00000000341A0000-0x00000000341B7000-memory.dmp

Filesize
92KB

Download
memory/604-205-0x0000000034240000-0x0000000034257000-memory.dmp

Filesize
92KB

Download
memory/988-135-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/988-133-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4272-140-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/4272-139-0x0000000000490000-0x00000000004A0000-memory.dmp

Filesize
64KB

Download