d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f

Analysis

max time kernel
19s
max time network
26s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
07/10/2023, 22:37

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe
Size

864KB
MD5

efaa1998d148d9dfee705f7e03df0dcc
SHA1

7909d77538550835814363cc896cde01d257cc1c
SHA256

d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f
SHA512

c7ced97f00a3639243b29d23c29ab04f89549b1bfe3bd868ed5a4bc7d5f58116c28be5cd47a2c0da8c44646a7ad69c8bf2d57b254d4cbab86871c8744d1856d1
SSDEEP

12288:FM/ZGp7Ri69qk/1TnUXAqlBl98maVH3MGrTMyM4Ip9Eo76:C/Ze7g69797oAkBlumatMKTM6I9Bm

Score

9^/10

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "137"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe
1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe
2444	LogonUI.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4048	1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe	92
PID 1612 wrote to memory of 4048	1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe	92
PID 1612 wrote to memory of 4048	1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe	92
PID 1612 wrote to memory of 904	1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe	94
PID 1612 wrote to memory of 904	1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe	94
PID 1612 wrote to memory of 904	1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe	94
PID 1612 wrote to memory of 1312	1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe	93
PID 1612 wrote to memory of 1312	1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe	93
PID 1612 wrote to memory of 1312	1612	d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe	93

C:\Users\Admin\AppData\Local\Temp\d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe
"C:\Users\Admin\AppData\Local\Temp\d7f17ceb5b3f8581896af586ed7377c86fc8d2928afd6a50138abed9e8fcac0f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\net.exe
  net user Administrator wsjcnmd
  2⤵
  PID:4048
- C:\Windows\SysWOW64\net.exe
  net localgroup administrators Éµ±Æ¶«Î÷ À´¼ÓÄãµùÎÒ½âËø»ú 3581098447 È¥ÄãÂè±ÆµÄ ksÐÂÊÀ½ç /add
  2⤵
  PID:1312
- C:\Windows\SysWOW64\net.exe
  net user Éµ±Æ¶«Î÷ À´¼ÓÄãµùÎÒ½âËø»ú 3581098447 È¥ÄãÂè±ÆµÄ ksÐÂÊÀ½ç wsjcnmd /add
  2⤵
  PID:904

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b8855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads