22edd9b0aa858616fb43b233990790562566f9674f202808a9931939bf5da004

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

39381974641f637e7faaf4e14f0197dc.exe
Size

252KB
MD5

39381974641f637e7faaf4e14f0197dc
SHA1

429621ed86c33c3ee9e24a640047aadaa29bc14a
SHA256

22edd9b0aa858616fb43b233990790562566f9674f202808a9931939bf5da004
SHA512

478eee8e7208064471f915751c029fe6a3ace24dac5394bb9469df1b5d483b294259edbaceae8a6fe03576e7dce6aa3d12c8d6d55649a1cb74b33ee63ea5a011
SSDEEP

6144:QVzVSleqEKiX2Lh7n0CqPgGATLZBBkhUt43essBAUz5WD:QV5SleqkkGCGA/deII

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\393819~1.EXE,"	39381974641f637e7faaf4e14f0197dc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\393819~1.EXE"	39381974641f637e7faaf4e14f0197dc.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\b0d48137 = "\x15\x0fP›\x02!‚æÁ\a6÷ß¿@Þ1và,†<¥Æs\a]ØXh±¡ö9L%rÌ9Å+`>ìV¢Z'0Š\u0090P\x03îkÉH½,!þ\x10ý~iÔ¼Úårw\\Ïwº.Ô\x06lR\x16èŒ.rüjÔ\u00818Ý\x0eê\x1co\u009dŽ4tqŽ„0Öox„\x1191–Xþì’}X\"ÒºÜ€\\ö•¤\x05_\\:\x01h0Ï\\_¤$NÀZT¾yAwMºé†MŒA…AIÆ4'út†Ôt!ÜÝì\x01Aº\n`±\n¬\x18±J‰þd\x11h/UtŒTŒtZÄ¾\rÇ…l¹4Œ<Ÿ5:\|¼\x7f4 æ°ú†<ê\x129TtHö¼xî\x14I5éjQ1Î¯”ÄRžÖÅD!`\tdì¤)Âên·/8\x06÷D:Ð^"	39381974641f637e7faaf4e14f0197dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\393819~1.EXE"	39381974641f637e7faaf4e14f0197dc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe
2264	39381974641f637e7faaf4e14f0197dc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2264	39381974641f637e7faaf4e14f0197dc.exe
Token: SeSecurityPrivilege	2264	39381974641f637e7faaf4e14f0197dc.exe
Token: SeSecurityPrivilege	2264	39381974641f637e7faaf4e14f0197dc.exe
Token: SeSecurityPrivilege	2264	39381974641f637e7faaf4e14f0197dc.exe

C:\Users\Admin\AppData\Local\Temp\39381974641f637e7faaf4e14f0197dc.exe
"C:\Users\Admin\AppData\Local\Temp\39381974641f637e7faaf4e14f0197dc.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2264-0-0x0000000000220000-0x0000000000266000-memory.dmp

Filesize
280KB

Download
memory/2264-1-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/2264-3-0x0000000002480000-0x0000000002532000-memory.dmp

Filesize
712KB

Download
memory/2264-5-0x0000000002480000-0x0000000002532000-memory.dmp

Filesize
712KB

Download
memory/2264-11-0x0000000002480000-0x0000000002532000-memory.dmp

Filesize
712KB

Download
memory/2264-9-0x0000000002480000-0x0000000002532000-memory.dmp

Filesize
712KB

Download
memory/2264-13-0x0000000002480000-0x0000000002532000-memory.dmp

Filesize
712KB

Download
memory/2264-7-0x0000000002480000-0x0000000002532000-memory.dmp

Filesize
712KB

Download
memory/2264-18-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-16-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-14-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-45-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-44-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-50-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-56-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-61-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-65-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-73-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-83-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-86-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-85-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-84-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-82-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-81-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-80-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-79-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-78-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-77-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-76-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-75-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-74-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-72-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-71-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-70-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-69-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-68-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-67-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-66-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-64-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-63-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-62-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-60-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-59-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-58-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-57-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-55-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-54-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-53-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-52-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-51-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-46-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-49-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-48-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-47-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-43-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-42-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-41-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-40-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download
memory/2264-682-0x0000000000220000-0x0000000000266000-memory.dmp

Filesize
280KB

Download
memory/2264-684-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/2264-685-0x0000000002640000-0x00000000026F8000-memory.dmp

Filesize
736KB

Download