Analysis
-
max time kernel
134s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 05:49
Static task
static1
Behavioral task
behavioral1
Sample
2aa80d3913a2d4541b9c948fb019b93d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2aa80d3913a2d4541b9c948fb019b93d.exe
Resource
win10v2004-20231215-en
General
-
Target
2aa80d3913a2d4541b9c948fb019b93d.exe
-
Size
32KB
-
MD5
2aa80d3913a2d4541b9c948fb019b93d
-
SHA1
e2b047974e184a24129116983730f286cca85163
-
SHA256
986ef3055fe3ec7a7495d2f0368c798ef4461c8c5af045760b819ee4b32e7c0b
-
SHA512
d08e68fcf2384f05bad0e9e367b735f392285f22b7f339c892ce08e924a828ea1643440be8b3c27b08f85f08de6030934a96f36b6f51daa4b495771d16aad434
-
SSDEEP
384:o/4acyoILe2QbrWyVtVSLo9L0nIRlQqNbH9eQNG9O1Vap9:otcyPYrWAt19XlH0QVa/
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
Processes:
winlogon.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List winlogon.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winlogon.exe" winlogon.exe -
Executes dropped EXE 1 IoCs
Processes:
winlogon.exepid process 2752 winlogon.exe -
Loads dropped DLL 2 IoCs
Processes:
2aa80d3913a2d4541b9c948fb019b93d.exepid process 2412 2aa80d3913a2d4541b9c948fb019b93d.exe 2412 2aa80d3913a2d4541b9c948fb019b93d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winlogon.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winlogon.exe" winlogon.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Corp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\winlogon.exe" winlogon.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2aa80d3913a2d4541b9c948fb019b93d.exedescription pid process target process PID 2412 wrote to memory of 2752 2412 2aa80d3913a2d4541b9c948fb019b93d.exe winlogon.exe PID 2412 wrote to memory of 2752 2412 2aa80d3913a2d4541b9c948fb019b93d.exe winlogon.exe PID 2412 wrote to memory of 2752 2412 2aa80d3913a2d4541b9c948fb019b93d.exe winlogon.exe PID 2412 wrote to memory of 2752 2412 2aa80d3913a2d4541b9c948fb019b93d.exe winlogon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aa80d3913a2d4541b9c948fb019b93d.exe"C:\Users\Admin\AppData\Local\Temp\2aa80d3913a2d4541b9c948fb019b93d.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\winlogon.exe"C:\Users\Admin\AppData\Local\Temp\winlogon.exe"2⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
PID:2752
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD52aa80d3913a2d4541b9c948fb019b93d
SHA1e2b047974e184a24129116983730f286cca85163
SHA256986ef3055fe3ec7a7495d2f0368c798ef4461c8c5af045760b819ee4b32e7c0b
SHA512d08e68fcf2384f05bad0e9e367b735f392285f22b7f339c892ce08e924a828ea1643440be8b3c27b08f85f08de6030934a96f36b6f51daa4b495771d16aad434