a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61

Analysis

max time kernel
146s
max time network
157s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 18:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
Size

304KB
MD5

5c70c2c0fc539d4e2b311eb2b98ad933
SHA1

cb392963f32260d5307720399a1a80cc2e62edb6
SHA256

a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61
SHA512

7033c34706ac113d5030badee58cc2b7fa827c48efed4048212b771e53db56c5ac3bfb3066499d297a418a03003519ccdbbbbf83439df5f9d3db81d3c395f7ba
SSDEEP

6144:RvvjEGrfvjyQ/MkL2DxOJrdHNzgedbHuLJ7gcEW67/Pi:hrfvjh/nSxOJrt9dzuL5g5RHi

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\A1C7E9~1.EXE,"	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A1C7E9~1.EXE"	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\8fba6b0c = "I\b‹\x0f\x17£ŒûÆI\x1bÿ¾–îáBú\x1b“Ø/:Ì˜Ç†4XT¯#G^Öqß\u009d\u008fu¸Ò§ß%”\fóë¶\x7f4Ó<ê4wË+g±_Frð\x1b§5gg7Ý%ò’î/\x0f\x17žÖÜ`yÖSÃ¤â™\\v\nž3\x01¡\x1fÆ9‡ÏäÔo(‡° à\x14Êì\x1f†ØBxO(\x18¶ØZ\nX\b`Ä”\x04\x12P§2?˜'\x12˜JO\x02Øw\|j²Î\u00a0îò×"	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\A1C7E9~1.EXE"	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
784	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
784	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
784	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
784	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
784	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
784	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
784	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	784	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
Token: SeSecurityPrivilege	784	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
Token: SeSecurityPrivilege	784	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
Token: SeSecurityPrivilege	784	a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe

C:\Users\Admin\AppData\Local\Temp\a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe
"C:\Users\Admin\AppData\Local\Temp\a1c7e92de5346746e41cece997f745638109e77f061e72042769164a642f1f61.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/784-54-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/784-55-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

Filesize
8KB

Download
memory/784-57-0x0000000002460000-0x0000000002512000-memory.dmp

Filesize
712KB

Download
memory/784-56-0x0000000002460000-0x0000000002512000-memory.dmp

Filesize
712KB

Download
memory/784-58-0x0000000002460000-0x0000000002512000-memory.dmp

Filesize
712KB

Download
memory/784-61-0x0000000002460000-0x0000000002512000-memory.dmp

Filesize
712KB

Download
memory/784-60-0x0000000002460000-0x0000000002512000-memory.dmp

Filesize
712KB

Download
memory/784-63-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/784-64-0x0000000002460000-0x0000000002512000-memory.dmp

Filesize
712KB

Download
memory/784-65-0x0000000002620000-0x00000000026D8000-memory.dmp

Filesize
736KB

Download
memory/784-66-0x000000007EF40000-0x000000007EFA9000-memory.dmp

Filesize
420KB

Download
memory/784-67-0x0000000002620000-0x00000000026D8000-memory.dmp

Filesize
736KB

Download