3a87152b59c7d10ce42a50478fe7776191023004da7a60bb21dc5847881fb9e7

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
aabc6b208bebc60a59919dbb1b05c073.exe
Size 439KB
Sample240107-x4a51adce4
SHA256 3a87152b59c7d10ce42a50478fe7776191023004da7a60bb21dc5847881fb9e7
MD5 aabc6b208bebc60a59919dbb1b05c073
SHA1 685a9ee9dd7665b8da2d4d32bdc6f26c000f4f7b
SHA512 5e60f8556472e73b68c849e338e0059620c245ffec45353b95591c96e8eab3a9d1c77230232309b7e6a7d2e5134ed543d86ff083dc1e91f24d8c0253927a6a17
SSDEEP 3072:TfTflRNjzPF5OncVbrCVru0K67rMjb+2:LTfbz5W6bEu0LMjb+2
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	aabc6b208bebc60a59919dbb1b05c073.exe

Executes dropped EXE 7 IoCs

pid	Process
2284	winlogon.exe
788	winlogon.exe
1088	winlogon.exe
4948	winlogon.exe
1228	winlogon.exe
2944	winlogon.exe
2764	winlogon.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4868-4-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4868-3-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4868-16-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/4868-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/788-28-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/788-34-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/788-40-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/788-46-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/788-51-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 1076 set thread context of 4868	1076	aabc6b208bebc60a59919dbb1b05c073.exe	15
PID 2284 set thread context of 788	2284	winlogon.exe	20
PID 788 set thread context of 1088	788	winlogon.exe	26
PID 788 set thread context of 4948	788	winlogon.exe	113
PID 788 set thread context of 1228	788	winlogon.exe	116
PID 788 set thread context of 2944	788	winlogon.exe	122
PID 788 set thread context of 2764	788	winlogon.exe	127

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1552	1088	WerFault.exe
1608	4948	WerFault.exe
5020	1228	WerFault.exe	116
3980	2944	WerFault.exe
4668	2764	WerFault.exe	127

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4868	aabc6b208bebc60a59919dbb1b05c073.exe
788	winlogon.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 3380	1076	aabc6b208bebc60a59919dbb1b05c073.exe	27
PID 1076 wrote to memory of 3380	1076	aabc6b208bebc60a59919dbb1b05c073.exe	27
PID 1076 wrote to memory of 3380	1076	aabc6b208bebc60a59919dbb1b05c073.exe	27
PID 1076 wrote to memory of 4868	1076	aabc6b208bebc60a59919dbb1b05c073.exe	15
PID 1076 wrote to memory of 4868	1076	aabc6b208bebc60a59919dbb1b05c073.exe	15
PID 1076 wrote to memory of 4868	1076	aabc6b208bebc60a59919dbb1b05c073.exe	15
PID 1076 wrote to memory of 4868	1076	aabc6b208bebc60a59919dbb1b05c073.exe	15
PID 1076 wrote to memory of 4868	1076	aabc6b208bebc60a59919dbb1b05c073.exe	15
PID 1076 wrote to memory of 4868	1076	aabc6b208bebc60a59919dbb1b05c073.exe	15
PID 1076 wrote to memory of 4868	1076	aabc6b208bebc60a59919dbb1b05c073.exe	15
PID 1076 wrote to memory of 4868	1076	aabc6b208bebc60a59919dbb1b05c073.exe	15
PID 4868 wrote to memory of 2284	4868	aabc6b208bebc60a59919dbb1b05c073.exe	22
PID 4868 wrote to memory of 2284	4868	aabc6b208bebc60a59919dbb1b05c073.exe	22
PID 4868 wrote to memory of 2284	4868	aabc6b208bebc60a59919dbb1b05c073.exe	22
PID 2284 wrote to memory of 828	2284	winlogon.exe	21
PID 2284 wrote to memory of 828	2284	winlogon.exe	21
PID 2284 wrote to memory of 828	2284	winlogon.exe	21
PID 2284 wrote to memory of 788	2284	winlogon.exe	20
PID 2284 wrote to memory of 788	2284	winlogon.exe	20
PID 2284 wrote to memory of 788	2284	winlogon.exe	20
PID 2284 wrote to memory of 788	2284	winlogon.exe	20
PID 2284 wrote to memory of 788	2284	winlogon.exe	20
PID 2284 wrote to memory of 788	2284	winlogon.exe	20
PID 2284 wrote to memory of 788	2284	winlogon.exe	20
PID 2284 wrote to memory of 788	2284	winlogon.exe	20
PID 788 wrote to memory of 1088	788	winlogon.exe	26
PID 788 wrote to memory of 1088	788	winlogon.exe	26
PID 788 wrote to memory of 1088	788	winlogon.exe	26
PID 788 wrote to memory of 1088	788	winlogon.exe	26
PID 788 wrote to memory of 1088	788	winlogon.exe	26
PID 788 wrote to memory of 1088	788	winlogon.exe	26
PID 788 wrote to memory of 1088	788	winlogon.exe	26
PID 788 wrote to memory of 1088	788	winlogon.exe	26
PID 788 wrote to memory of 4948	788	winlogon.exe	113
PID 788 wrote to memory of 4948	788	winlogon.exe	113
PID 788 wrote to memory of 4948	788	winlogon.exe	113
PID 788 wrote to memory of 4948	788	winlogon.exe	113
PID 788 wrote to memory of 4948	788	winlogon.exe	113
PID 788 wrote to memory of 4948	788	winlogon.exe	113
PID 788 wrote to memory of 4948	788	winlogon.exe	113
PID 788 wrote to memory of 4948	788	winlogon.exe	113
PID 788 wrote to memory of 1228	788	winlogon.exe	116
PID 788 wrote to memory of 1228	788	winlogon.exe	116
PID 788 wrote to memory of 1228	788	winlogon.exe	116
PID 788 wrote to memory of 1228	788	winlogon.exe	116
PID 788 wrote to memory of 1228	788	winlogon.exe	116
PID 788 wrote to memory of 1228	788	winlogon.exe	116
PID 788 wrote to memory of 1228	788	winlogon.exe	116
PID 788 wrote to memory of 1228	788	winlogon.exe	116
PID 788 wrote to memory of 2944	788	winlogon.exe	122
PID 788 wrote to memory of 2944	788	winlogon.exe	122
PID 788 wrote to memory of 2944	788	winlogon.exe	122
PID 788 wrote to memory of 2944	788	winlogon.exe	122
PID 788 wrote to memory of 2944	788	winlogon.exe	122
PID 788 wrote to memory of 2944	788	winlogon.exe	122
PID 788 wrote to memory of 2944	788	winlogon.exe	122
PID 788 wrote to memory of 2944	788	winlogon.exe	122
PID 788 wrote to memory of 2764	788	winlogon.exe	127
PID 788 wrote to memory of 2764	788	winlogon.exe	127
PID 788 wrote to memory of 2764	788	winlogon.exe	127
PID 788 wrote to memory of 2764	788	winlogon.exe	127
PID 788 wrote to memory of 2764	788	winlogon.exe	127
PID 788 wrote to memory of 2764	788	winlogon.exe	127
PID 788 wrote to memory of 2764	788	winlogon.exe	127

C:\Users\Admin\AppData\Local\Temp\aabc6b208bebc60a59919dbb1b05c073.exe
"C:\Users\Admin\AppData\Local\Temp\aabc6b208bebc60a59919dbb1b05c073.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\aabc6b208bebc60a59919dbb1b05c073.exe
  2⤵
  - Checks computer location settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Users\Admin\E696D64614\winlogon.exe
    "C:\Users\Admin\E696D64614\winlogon.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2284
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\\svchost.exe
  2⤵
  PID:3380

C:\Users\Admin\E696D64614\winlogon.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:788
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  PID:4948
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  PID:1228
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 12
    3⤵
    - Program crash
    PID:5020
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Users\Admin\E696D64614\winlogon.exe
  "C:\Users\Admin\E696D64614\winlogon.exe"
  2⤵
  - Executes dropped EXE
  PID:2764
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 12
    3⤵
    - Program crash
    PID:4668

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
1⤵
PID:828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1088 -ip 1088
1⤵
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 12
1⤵
- Program crash
PID:1552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4948 -s 12
1⤵
- Program crash
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4948 -ip 4948
1⤵
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1228 -ip 1228
1⤵
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 12
1⤵
- Program crash
PID:3980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2944 -ip 2944
1⤵
PID:220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2764 -ip 2764
1⤵
PID:5024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winlogon.exe

Path C:\Users\Admin\E696D64614\winlogon.exe
Size 382KB
SHA256 8e51de071c62e3886cc8b64c01a199588369eca1a1a3d2461a2ccf8e7304ec95
MD5 05a3c21a604e6ad025e8e4821482e92f
SHA1 f4202a4ec8e725a7e3850d2f04dcdb8b74383f3f
SHA512 ab764c1cbd086fbe3dba6bf59184d6c01cd50c542cfcb1dd9fc43e5e619296fd86399678ee03f400add213784779f3383591a6f9f3f0e7861086e1db54a0a300
SSDEEP 3072:TfTflRNjzPF5OncVbrCVru0K67rMjb+2:LTfbz5W6bEu0LMjb+2
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\E696D64614\winlogon.exe
Size 384KB
SHA256 ce710b159f6d2e239c2ca6a5bcae7a28dff71ab385a87d72a05996f13aa284d8
MD5 37a5390ba194fb2fe8d714119f090c17
SHA1 736566451c5fcd80e19ddbcf07bd51fd4b64a4f1
SHA512 8b1115604813e008ccbb2f411cebcf4fdcc8470de9b0f8a792f6fa9282df5bca6c55b22cb8af92c1522b8ff17bad2ecf968895d94909e00df2c03f3e82f67ce8
SSDEEP 3072:TfTflRNjzPF5OncVbrCVru0K67rMjb+2:LTfbz5W6bEu0LMjb+2
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\E696D64614\winlogon.exe
Size 92KB
SHA256 b98dcac3180a904a8185c0a9dd0c2abe8e9bb4cf37f80858dd6925f6bbb09601
MD5 aab9cc5a4b833386c1ea90b265a0c922
SHA1 08c684f67e3db68ea7bb981f8f433f713939b032
SHA512 83297b62be740963d1e87db05da635543b79f73e213d38de571621bed5d1f15f6f865f4082d24213b28e8e3913a27bbe810b8d8ff8631805015e8e5d5f9ba90a
SSDEEP 1536:TrLTxFl5XNjzPdDXJOw9NsJBeVYJj+lNE2CVrHzKwY0zPL6tkSc776+p+:TfTflRNjzPF5OncVbrCVru0K67rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\E696D64614\winlogon.exe
Size 439KB
SHA256 3a87152b59c7d10ce42a50478fe7776191023004da7a60bb21dc5847881fb9e7
MD5 aabc6b208bebc60a59919dbb1b05c073
SHA1 685a9ee9dd7665b8da2d4d32bdc6f26c000f4f7b
SHA512 5e60f8556472e73b68c849e338e0059620c245ffec45353b95591c96e8eab3a9d1c77230232309b7e6a7d2e5134ed543d86ff083dc1e91f24d8c0253927a6a17
SSDEEP 3072:TfTflRNjzPF5OncVbrCVru0K67rMjb+2:LTfbz5W6bEu0LMjb+2
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlogon.exe

Path C:\Users\Admin\E696D64614\winlogon.exe
Size 136KB
SHA256 d17955175cff028ee1f949e08394b3c7bb17b04dc8483fc5dd78329a13381062
MD5 a45267e45651d3b93b6db1fed760322e
SHA1 af89cf1685d48725ebf6142e0b677198d4f1a49c
SHA512 b2468ceef509ba32597ac28695fc1dfdf6f7a3158669d985208abf3751c73b0b6f208f5e6f7f8610058c6edfb027be3c73054ff16b71cb6c8b798d0dcfab890b
SSDEEP 3072:TfTflRNjzPF5OncVbrCVru0K67rMjb+2:LTfbz5W6bEu0LMjb+2
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/788-46-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/788-51-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/788-40-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/788-28-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/788-34-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/1076-1-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2284-20-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4868-16-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4868-0-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4868-3-0x0000000000400000-0x000000000041C000-memory.dmp

Download

memory/4868-4-0x0000000000400000-0x000000000041C000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads