ad3bcb65313043b1a43b8fb210f3a20a87df8a8145ed9a18b086d0859616caa2

Analysis

max time kernel
139s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
23-10-2023 21:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab4fa067af1c9a107b879341e255eb9f05779608ce31217c1a2d60d28a2c8838.exe
Size

84KB
MD5

7d3294046b8db4fa7229ea4e226808c9
SHA1

3586e1d378e8547b0d7c3eb58fcbf9d789b1981d
SHA256

ab4fa067af1c9a107b879341e255eb9f05779608ce31217c1a2d60d28a2c8838
SHA512

4028df37dc553d47141f32a6e09019878ef66923f2fa87f17ae2b0f4068d11b7f4e10a22acf9120f710151a638bbf9a5fd121b6876361e23df36ecdc12b1c07a
SSDEEP

1536:6C8Kd354Ru7qqWIk0rJ771bI6tcMCFnZGqckwVXicpt:6C8AJR/tH1b/GZtckwVXTpt

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

ab4fa067af1c9a107b879341e255eb9f05779608ce31217c1a2d60d28a2c8838.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\AB4FA0~1.EXE"	ab4fa067af1c9a107b879341e255eb9f05779608ce31217c1a2d60d28a2c8838.exe

C:\Users\Admin\AppData\Local\Temp\ab4fa067af1c9a107b879341e255eb9f05779608ce31217c1a2d60d28a2c8838.exe
"C:\Users\Admin\AppData\Local\Temp\ab4fa067af1c9a107b879341e255eb9f05779608ce31217c1a2d60d28a2c8838.exe"
1⤵
- Modifies WinLogon for persistence
PID:1232

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads