47b64c157297192f7b7bb9eb361344af9c245449a30d8d17d13eae9c51cad3ff

Analysis

max time kernel
136s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
30/12/2023, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1d1c4bb3ab22d954ada3ac165787d202.exe
Size

3.3MB
MD5

1d1c4bb3ab22d954ada3ac165787d202
SHA1

2d5ded6c684d69e070af584a605526817f1c2990
SHA256

47b64c157297192f7b7bb9eb361344af9c245449a30d8d17d13eae9c51cad3ff
SHA512

2e7176571d749c7d6105475b85ad3f99523fc9747a31401728cae099cde074c137518ad154107c02187f93d241545e9c4eb514afa225838dae8b45aa42f5a56d
SSDEEP

98304:3zouAywwGsaII1AcnzKfpHTYbBRNcP8U:UOGXHKfZq

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ ANT = "C:\\Windows\\winhelp32.exe"	1d1c4bb3ab22d954ada3ac165787d202.exe

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ascfix\Asynchronous = "0"	1d1c4bb3ab22d954ada3ac165787d202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ascfix\Dllname = "asterix.dll"	1d1c4bb3ab22d954ada3ac165787d202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ascfix\Startup = "WlxEventLogon"	1d1c4bb3ab22d954ada3ac165787d202.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ascfix\Logon = "WlxEventLogon"	1d1c4bb3ab22d954ada3ac165787d202.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ascfix	1d1c4bb3ab22d954ada3ac165787d202.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	1d1c4bb3ab22d954ada3ac165787d202.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ascfix\Impersonate = "0"	1d1c4bb3ab22d954ada3ac165787d202.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\asterix.dll	1d1c4bb3ab22d954ada3ac165787d202.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\netfx20.exe	1d1c4bb3ab22d954ada3ac165787d202.exe
File created	C:\Windows\1-1-2024_6-29-06_AM_AVCIKYMG_1280x720.txt	1d1c4bb3ab22d954ada3ac165787d202.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2992	1292	WerFault.exe	16

C:\Users\Admin\AppData\Local\Temp\1d1c4bb3ab22d954ada3ac165787d202.exe
"C:\Users\Admin\AppData\Local\Temp\1d1c4bb3ab22d954ada3ac165787d202.exe"
1⤵
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Windows directory
PID:1292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1292 -s 768
  2⤵
  - Program crash
  PID:2992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1292 -ip 1292
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-0-0x0000000000400000-0x0000000000C7C000-memory.dmp

Filesize
8.5MB

Download
memory/1292-1-0x0000000000DA0000-0x0000000000DA2000-memory.dmp

Filesize
8KB

Download
memory/1292-2-0x0000000002A60000-0x0000000002A61000-memory.dmp

Filesize
4KB

Download
memory/1292-7-0x0000000000400000-0x0000000000C7C000-memory.dmp

Filesize
8.5MB

Download
memory/1292-9-0x0000000000DA0000-0x0000000000DA2000-memory.dmp

Filesize
8KB

Download
memory/1292-12-0x0000000000400000-0x0000000000C7C000-memory.dmp

Filesize
8.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads