af54cc0282547ff0e74d3c9018273ae4439446b92e8eba33b9cb3c96a691e239

General

Target

5a55e941dcb0c5exeexeexeex.exe
Size

280KB
MD5

5a55e941dcb0c5d638e3a38841117e77
SHA1

003fb16698a4cd37ff416d7e078cfcbad0849d25
SHA256

af54cc0282547ff0e74d3c9018273ae4439446b92e8eba33b9cb3c96a691e239
SHA512

fcd511031ea825f0da1b4fcbe313a9b026dbbf146e8b32c66358bf8f594f775f39cd8dba8339dd3a80fcc268e3be7ad2c2fc9cff65caa336832b73d56c2c737c
SSDEEP

6144:ZTz+WrPFZvTXb4RyW42vFlOloh2E+7pYUozDK:ZTBPFV0RyWl3h2E+7pl

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2852	wlogon32.exe
1164	wlogon32.exe

Loads dropped DLL 3 IoCs

pid	Process
3016	5a55e941dcb0c5exeexeexeex.exe
3016	5a55e941dcb0c5exeexeexeex.exe
3016	5a55e941dcb0c5exeexeexeex.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\DefaultIcon	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\ = "Application"	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\Content-Type = "application/x-msdownload"	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\shell\runas\command\IsolatedCommand = "\"%1\" %*"	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*"	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\shell\runas\command\ = "\"%1\" %*"	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\ = "haldriver"	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*"	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\shell\open\command	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\wlogon32.exe\" /START \"%1\" %*"	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\shell\runas\command	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\Content-Type = "application/x-msdownload"	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\DefaultIcon	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\shell\open	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\shell\open	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\shell	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\shell\open\command	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Sys32\\wlogon32.exe\" /START \"%1\" %*"	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*"	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\shell\open\command\IsolatedCommand = "\"%1\" %*"	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\shell\runas	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\DefaultIcon\ = "%1"	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\shell	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\shell\runas	5a55e941dcb0c5exeexeexeex.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\haldriver\DefaultIcon\ = "%1"	5a55e941dcb0c5exeexeexeex.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.exe\shell\runas\command	5a55e941dcb0c5exeexeexeex.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2852	wlogon32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2852	3016	5a55e941dcb0c5exeexeexeex.exe	28
PID 3016 wrote to memory of 2852	3016	5a55e941dcb0c5exeexeexeex.exe	28
PID 3016 wrote to memory of 2852	3016	5a55e941dcb0c5exeexeexeex.exe	28
PID 3016 wrote to memory of 2852	3016	5a55e941dcb0c5exeexeexeex.exe	28
PID 2852 wrote to memory of 1164	2852	wlogon32.exe	29
PID 2852 wrote to memory of 1164	2852	wlogon32.exe	29
PID 2852 wrote to memory of 1164	2852	wlogon32.exe	29
PID 2852 wrote to memory of 1164	2852	wlogon32.exe	29

C:\Users\Admin\AppData\Local\Temp\5a55e941dcb0c5exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\5a55e941dcb0c5exeexeexeex.exe"
1⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe" /START "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe"
    3⤵
    - Executes dropped EXE
    PID:1164

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe

Filesize
280KB

MD5
62acb049b8a4e41b4b9c803fa1df3f66

SHA1
d2da240dff637ce990be66e2c6af1384d44ca4e4

SHA256
a4a44bc9965a50d80680d8f8b76b62e9a6dcd60a9f6279f2ddeae8063518cc92

SHA512
74768a841399c3bef2ce1d1a6c9c6087a1421e99e92fc378a68221988b0a1e50f93822f9d9af1dfee04a2055f3cb8fc41d16d868d5e5c38b4be9ae2ec9a7aa95

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe

Filesize
280KB

MD5
62acb049b8a4e41b4b9c803fa1df3f66

SHA1
d2da240dff637ce990be66e2c6af1384d44ca4e4

SHA256
a4a44bc9965a50d80680d8f8b76b62e9a6dcd60a9f6279f2ddeae8063518cc92

SHA512
74768a841399c3bef2ce1d1a6c9c6087a1421e99e92fc378a68221988b0a1e50f93822f9d9af1dfee04a2055f3cb8fc41d16d868d5e5c38b4be9ae2ec9a7aa95

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe

Filesize
280KB

MD5
62acb049b8a4e41b4b9c803fa1df3f66

SHA1
d2da240dff637ce990be66e2c6af1384d44ca4e4

SHA256
a4a44bc9965a50d80680d8f8b76b62e9a6dcd60a9f6279f2ddeae8063518cc92

SHA512
74768a841399c3bef2ce1d1a6c9c6087a1421e99e92fc378a68221988b0a1e50f93822f9d9af1dfee04a2055f3cb8fc41d16d868d5e5c38b4be9ae2ec9a7aa95

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe

Filesize
280KB

MD5
62acb049b8a4e41b4b9c803fa1df3f66

SHA1
d2da240dff637ce990be66e2c6af1384d44ca4e4

SHA256
a4a44bc9965a50d80680d8f8b76b62e9a6dcd60a9f6279f2ddeae8063518cc92

SHA512
74768a841399c3bef2ce1d1a6c9c6087a1421e99e92fc378a68221988b0a1e50f93822f9d9af1dfee04a2055f3cb8fc41d16d868d5e5c38b4be9ae2ec9a7aa95

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe

Filesize
280KB

MD5
62acb049b8a4e41b4b9c803fa1df3f66

SHA1
d2da240dff637ce990be66e2c6af1384d44ca4e4

SHA256
a4a44bc9965a50d80680d8f8b76b62e9a6dcd60a9f6279f2ddeae8063518cc92

SHA512
74768a841399c3bef2ce1d1a6c9c6087a1421e99e92fc378a68221988b0a1e50f93822f9d9af1dfee04a2055f3cb8fc41d16d868d5e5c38b4be9ae2ec9a7aa95

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe

Filesize
280KB

MD5
62acb049b8a4e41b4b9c803fa1df3f66

SHA1
d2da240dff637ce990be66e2c6af1384d44ca4e4

SHA256
a4a44bc9965a50d80680d8f8b76b62e9a6dcd60a9f6279f2ddeae8063518cc92

SHA512
74768a841399c3bef2ce1d1a6c9c6087a1421e99e92fc378a68221988b0a1e50f93822f9d9af1dfee04a2055f3cb8fc41d16d868d5e5c38b4be9ae2ec9a7aa95

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Sys32\wlogon32.exe

Filesize
280KB

MD5
62acb049b8a4e41b4b9c803fa1df3f66

SHA1
d2da240dff637ce990be66e2c6af1384d44ca4e4

SHA256
a4a44bc9965a50d80680d8f8b76b62e9a6dcd60a9f6279f2ddeae8063518cc92

SHA512
74768a841399c3bef2ce1d1a6c9c6087a1421e99e92fc378a68221988b0a1e50f93822f9d9af1dfee04a2055f3cb8fc41d16d868d5e5c38b4be9ae2ec9a7aa95

Download Submit

Analysis

Sharing