Analysis
-
max time kernel
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01-01-2024 17:26
Static task
static1
Behavioral task
behavioral1
Sample
3d71102513741625e44562098fd655ee.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3d71102513741625e44562098fd655ee.exe
Resource
win10v2004-20231222-en
General
-
Target
3d71102513741625e44562098fd655ee.exe
-
Size
241KB
-
MD5
3d71102513741625e44562098fd655ee
-
SHA1
df9b61f87ef043515caafeee403443ba2eebdd60
-
SHA256
5c20b43066d31ac310a4b41d2103c7e5f1e2c97301ac572d277acc12e17348af
-
SHA512
5825f3e85b740ae3842b3e69f2f00f81f01e9737ad136eed4c89fcc1a4e378d3bcb93f8aad5536a73f1111270f5df2ce0b1853d34652dc924492550a315eb2a5
-
SSDEEP
6144:CsY7cf92DU4H9nBn4hbbuVyUWYgH4Va5X3g4sVs:CSFufH1BnOPuPM4OX3gts
Malware Config
Signatures
-
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\8d984193 = "žÑ{\x0e\vÚþCÑ–4Y\nõ\x01½ÀxŸá§¢hï+¤2Xà‡•¾H@\x06\x18TÁ\x02øé\u008d…ƒ/Ï¡þjö¦€Ôý\x19\x01\u00ad\"\x18\x15ôzX\x18=ev†È\x1e\aÜ{W#\a-\x18%„༨\u00a0€,ä3\u0090£8Ð{s¤@ý_\x1b\u009d¤#$ÐõôˆÜøK\x10ó\fÿk\u0090ô\b/-…sGk»+•ðG\x18d‹\x10{ãO4|@sÏ\u0090\x1bˆÍ\x04“ëdã“3H;Eã\\ࣔƒ³ÈD\u0090kh7\\Ï£í”7k“È“[Ûƒ\x05ì¬Ë@\x1c|•ß7¸\x10à€ð\x03£—€¨œô”\x17/³TS7õD$£åã‹{\x1bKD|”€\x03wx³\x04@…{3\x14`àhÍPÜ\x1cåÌ=³7$3ð\x10ÌX¸\u008f›íãÔ¤õ8d984193" 3d71102513741625e44562098fd655ee.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe 464 3d71102513741625e44562098fd655ee.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeSecurityPrivilege 464 3d71102513741625e44562098fd655ee.exe Token: SeSecurityPrivilege 464 3d71102513741625e44562098fd655ee.exe Token: SeSecurityPrivilege 464 3d71102513741625e44562098fd655ee.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53861682f66133ab2c279b6235035b069
SHA1ba05857f34ac27e23211c6da631598a2a4c90563
SHA256d9f08a5230e505d1c29b5434507653ddf554cf0c4de3eed62d306f0241354028
SHA51211bbeca4272f29c804d8397a5d3a50e7341e3512c401107cb2962c57422085c7954a4850d2300a45b436c7f4d35a88702bf27ea7fecbf102eb95508ae1fb92ab
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
1KB
MD542fcb42052e29f3d29cd01cb6ada8dcb
SHA11b5a5714caf37693999b1856163fe410535c1b7e
SHA256c61c848febd50af2284bbab567476b2cec68570413166efd1cf5203300f6a144
SHA51275021980471b1f592f57d4a6dcda8a92d3e9d5ac0aa58b365a9d7a6a2d30e9fcac0890fc8e3c65df0f4898d886f2151256cae513ae461984d496d7b4ea4a97b3