7dfaf7dcb5e4a600c2dde4f2627dda36a2e5afdf8c41d077a9eeb2ca8a40bc93

Analysis

max time kernel
152s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 20:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03737b0acc09c43872f87b72f8a48108.exe
Size

277KB
MD5

03737b0acc09c43872f87b72f8a48108
SHA1

36b6ac40d57ae7ecb5753d5b43fc58e4a7fa7109
SHA256

7dfaf7dcb5e4a600c2dde4f2627dda36a2e5afdf8c41d077a9eeb2ca8a40bc93
SHA512

3c0753e763ed94a153953d760079a315bee00f21de5f906400afa8aa748d2c57056db72fb1c9668e4bea92e0412b5c3fe0e7dda78cccaebd8270dd1e1d727b27
SSDEEP

6144:aV1VjlMindSC/xSAZ21ICSFjmf9fWDCxS2K0naW+tIqlnlkka:a1jlMiSGxBUVSFmf9fx2G4eu6r

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\03737B~1.EXE,"	03737b0acc09c43872f87b72f8a48108.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\03737B~1.EXE"	03737b0acc09c43872f87b72f8a48108.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\6d64b838 = "·oy\n•‚_\x1c)\x1crè–!j\x7fdíá\aË\u008dÐ±Ñ„vúàø`áVX]Õ:Õ\tO¿e\x1c„Ü§f€\u00ad—3ÜR<\t´Òÿ\v§NÀ½\|\x1ceÈ\x18¼`\x05Ml%<m\x17ï%\x16D\x17õý‡\x1fÎÔŽ=wææ>†í6¤Î\x0e¬„Œ4ü¥wO–\x15\x7fn-ÅÝœ\x0fäg\räï¾\x04/?ÝÍ],\u009dEïG¥f4^\x04\x7fÔg\u00adìf]õf.OG%Ô-ôÆý~W'\x17—\x17Æ\aì]fý…\x17•\a–V~?¶Ý¶'ô¾\u008d$\u00adÍŽ½_å”\u008f†Öµ%ç\x0eMÿ}ÄeMìeeg¤ÿ7¥\x05O\u00ad§¯Gt\u00ad…¾'ö—]Ul‡%‡$=\u009d/fœ]TÅ]—ôgõþ\aô¯\x17†-Võ¥\x15¯\x1fÆ"	03737b0acc09c43872f87b72f8a48108.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\03737B~1.EXE"	03737b0acc09c43872f87b72f8a48108.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe
2812	03737b0acc09c43872f87b72f8a48108.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2812	03737b0acc09c43872f87b72f8a48108.exe
Token: SeSecurityPrivilege	2812	03737b0acc09c43872f87b72f8a48108.exe
Token: SeSecurityPrivilege	2812	03737b0acc09c43872f87b72f8a48108.exe
Token: SeSecurityPrivilege	2812	03737b0acc09c43872f87b72f8a48108.exe

C:\Users\Admin\AppData\Local\Temp\03737b0acc09c43872f87b72f8a48108.exe
"C:\Users\Admin\AppData\Local\Temp\03737b0acc09c43872f87b72f8a48108.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2812-0-0x0000000002300000-0x0000000002367000-memory.dmp

Filesize
412KB

Download
memory/2812-1-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2812-3-0x00000000027D0000-0x0000000002882000-memory.dmp

Filesize
712KB

Download
memory/2812-4-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-6-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-7-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-10-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-9-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-65-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-66-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-74-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-79-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-82-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-86-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-89-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-92-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-94-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-96-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-100-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-102-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-108-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-110-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-113-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-115-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-119-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-111-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-109-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-106-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-107-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-105-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-101-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-98-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-88-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-84-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-72-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-71-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-70-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-69-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-68-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-67-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-64-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-63-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download
memory/2812-1089-0x0000000002300000-0x0000000002367000-memory.dmp

Filesize
412KB

Download
memory/2812-1325-0x0000000000400000-0x0000000000555000-memory.dmp

Filesize
1.3MB

Download
memory/2812-1604-0x0000000002990000-0x0000000002A48000-memory.dmp

Filesize
736KB

Download