956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14

Analysis

max time kernel
193s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14.exe
Size

178KB
MD5

061a4bef4bbffe70b3ff6000a7412fe2
SHA1

92ed97191c79fae0498f2ab3c01cec7f38dad94e
SHA256

956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14
SHA512

7bff0cd42266bcf8c9feadcc99996faac455638edbb43b2af1b201c558b0ceb44cbb1cd6120adf8e808b4c70b6ab565d42e865ab147775aef5e1e36c5ef5c9a6
SSDEEP

3072:dejlLAUr08Vi7SmKWoWG7RRETY9MVrrBVJQ9d17SAORUDzavZ:LQ7E93u9GTM

Score

6^/10

persistence

Malware Config

Signatures

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Universal = "0"	956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14.exe
File opened for modification	C:\autorun.inf	956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1276	956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1276	956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1276	956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14.exe

C:\Users\Admin\AppData\Local\Temp\956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14.exe
"C:\Users\Admin\AppData\Local\Temp\956b0c46939156b15831b3de97d4bf19d23a1c4c2b4726df97d55783cfe79b14.exe"
1⤵
- Modifies WinLogon
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1276

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-132-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download
memory/1276-133-0x00000000753A0000-0x0000000075951000-memory.dmp

Filesize
5.7MB

Download