5c5ce3dbe4a32ae821e2bf29e6e2783d515aeaf8436aff940b04f014fba620d6

Analysis

max time kernel
9s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28/12/2023, 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd264de5cb5aedfd6c46a3c73a7b33d2.exe
Size

273KB
MD5

fd264de5cb5aedfd6c46a3c73a7b33d2
SHA1

32fa8729610835496387fd10f879634e1231ec0c
SHA256

5c5ce3dbe4a32ae821e2bf29e6e2783d515aeaf8436aff940b04f014fba620d6
SHA512

6e0addad507788ebcd8093cc37ec8d3482f93847cb710fc0e84a6cda027b31568e9d18e03781ac65b1a967d440920ac6791525adde5cacd10e133554cc44c1b1
SSDEEP

6144:NAe1anwI/XIIGy02QX7XJby1r2wEvC/bZTr4m971w1zhwz:NAe1awI/XTGyf27XJ+1r2wdtV1W1zU

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\FD264D~1.EXE,"	fd264de5cb5aedfd6c46a3c73a7b33d2.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FD264D~1.EXE"	fd264de5cb5aedfd6c46a3c73a7b33d2.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\c6b73885 = "L˜\x0fº\x01Ñ\u008d§Ê+f\x1b&Å{ù4\x0fˆlÃŒÂbÈÄ¥\x18o\x1bxwF¯Ø$š\x15\x10´jÝÀ¸¯Í\x13ÜzkÀ\x1cã\|>\vSQ•2à\x15\võúF†6GR¯P+t\x10F‚\u008fTâb]—¯O\x0fÆµ°ª\r\\d~ïG7û+P\nFê–gòKêèÖÏ\x05>7Z\"\u009d]”pvl5gZ\x0f³\|;êk•\u008dèîl74\|ä¯¸G?oçÃ—õXä\x1fv\u008dæ~øÜ•åE@m k/Þ«\x1a’Ï§¤èœ\x02¨\x7f+~\x1dßr\x1fçk\x13½XbÆJ—/”Öc‚ŸúÜD„nÖ[\x02Í˜OËWW\x1bK'PâËZ“ø+Làç*õ¿õ.\x1f‡ÛÝZ˜Ð\v…\x0e.\u008fœÂ²ÆèÆ(d^jâ\aÖãJ¿¶"	fd264de5cb5aedfd6c46a3c73a7b33d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FD264D~1.EXE"	fd264de5cb5aedfd6c46a3c73a7b33d2.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1600	fd264de5cb5aedfd6c46a3c73a7b33d2.exe
1600	fd264de5cb5aedfd6c46a3c73a7b33d2.exe
1600	fd264de5cb5aedfd6c46a3c73a7b33d2.exe
1600	fd264de5cb5aedfd6c46a3c73a7b33d2.exe
1600	fd264de5cb5aedfd6c46a3c73a7b33d2.exe
1600	fd264de5cb5aedfd6c46a3c73a7b33d2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1600	fd264de5cb5aedfd6c46a3c73a7b33d2.exe
Token: SeSecurityPrivilege	1600	fd264de5cb5aedfd6c46a3c73a7b33d2.exe
Token: SeSecurityPrivilege	1600	fd264de5cb5aedfd6c46a3c73a7b33d2.exe
Token: SeSecurityPrivilege	1600	fd264de5cb5aedfd6c46a3c73a7b33d2.exe

C:\Users\Admin\AppData\Local\Temp\fd264de5cb5aedfd6c46a3c73a7b33d2.exe
"C:\Users\Admin\AppData\Local\Temp\fd264de5cb5aedfd6c46a3c73a7b33d2.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1600-0-0x000000007FDE0000-0x000000007FE49000-memory.dmp

Filesize
420KB

Download
memory/1600-1-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1600-3-0x00000000022E0000-0x0000000002392000-memory.dmp

Filesize
712KB

Download
memory/1600-4-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-7-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-10-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-9-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-6-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-61-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-70-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-73-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-85-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-87-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-98-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-107-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-106-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-108-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-111-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-105-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-103-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-104-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-102-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-101-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-100-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-99-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-97-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-95-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-86-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-84-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-83-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-82-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-81-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-80-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-79-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-78-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-75-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-69-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-67-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-68-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-66-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-65-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-64-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-63-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-62-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-60-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-59-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-58-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-57-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-56-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-55-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download
memory/1600-694-0x000000007FDE0000-0x000000007FE49000-memory.dmp

Filesize
420KB

Download
memory/1600-697-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1600-827-0x0000000002980000-0x0000000002A38000-memory.dmp

Filesize
736KB

Download