39ae018f73b97f159e7a406ea96d1af1e54fe51f5377b6813d4b38ac81c869c6 | Triage

Analysis

max time kernel
31s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29-12-2022 18:33

Sharing

Reason

Machine shutdown

Report Analysis Logs

General

Target

Scanner.exe
Size

7.4MB
MD5

e2057aaea8e58425a4180d2b905f95d2
SHA1

acb25fa1cad1a550a5cbcaa2be41e90873c039bb
SHA256

39ae018f73b97f159e7a406ea96d1af1e54fe51f5377b6813d4b38ac81c869c6
SHA512

dcf2973e209f88c98fa13727abb2272b38cb329dd0ad87390bcd4a91b70a69718c6ba3859df324fb900a75e839494e96582da8fea259caf574f2ab562ef21c00
SSDEEP

98304:fVvoygIM7g0yNGu80jgCrME+j8obDdKauZ+ngSqd:9vo7g/o0/ME+QobUauZYgrd

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4188	Scanner64.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "147"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4932	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4188	4968	Scanner.exe	85
PID 4968 wrote to memory of 4188	4968	Scanner.exe	85

C:\Users\Admin\AppData\Local\Temp\Scanner.exe
"C:\Users\Admin\AppData\Local\Temp\Scanner.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\Scanner64.exe
  C:\Users\Admin\AppData\Local\Temp\Scanner64.exe
  2⤵
  - Executes dropped EXE
  PID:4188

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3980055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Scanner64.exe

Filesize
4.2MB

MD5
1bab36b4e9fe3345c1b8ff03209bbd53

SHA1
552d75bdc7413acbc880ec785685a0c15d4ce34e

SHA256
5fd943c59f2a2f988ba6a740ecc3e0b36e4250d461abaf11808c249d52473f29

SHA512
50c24f1d8d720ccd7207fcabc9e21c5c6cece3f627406bf45dc5ecaeb7a4fd2d0e0a89fa0dba615136f1c9b57efe212e1f2964a3b7707e81fbb1f7d51fb5bfb3

Download Submit