Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2024, 20:16

General

  • Target

    54074f3be610082a2eb3a2d747bfc165.exe

  • Size

    277KB

  • MD5

    54074f3be610082a2eb3a2d747bfc165

  • SHA1

    c646aff9570c83b29ed9a3c4bc9769c9337fccac

  • SHA256

    66c291b7bc444a20b027b868abaf06162ab9233eb3af5b4fd65a1fd03b785daa

  • SHA512

    f9387d69ef90946c38dcb38256177d746f8af4f3c0ed8f2cdf5951e2ead09141a090b6b9d717602973c0710c13dfec04d6afb1d3749eea9609e574a470a64973

  • SSDEEP

    6144:h1TnDzopfUxko17BX/ECry0Eya7dSYl0Od/P+9:h1TDeo59EgUgYl08+

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\54074f3be610082a2eb3a2d747bfc165.exe
    "C:\Users\Admin\AppData\Local\Temp\54074f3be610082a2eb3a2d747bfc165.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:408

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/408-0-0x0000000000400000-0x0000000000474000-memory.dmp

          Filesize

          464KB

        • memory/408-1-0x000000007FDE0000-0x000000007FE49000-memory.dmp

          Filesize

          420KB

        • memory/408-2-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/408-4-0x00000000026D0000-0x0000000002782000-memory.dmp

          Filesize

          712KB

        • memory/408-5-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-7-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-8-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-10-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-11-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-58-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-64-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-66-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-67-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-71-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-65-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-63-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-76-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-77-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-79-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-83-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-86-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-82-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-88-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-81-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-91-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-95-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-97-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-99-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-102-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-103-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-105-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-100-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-112-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-93-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-90-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-74-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-62-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-61-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-60-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-59-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-57-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB

        • memory/408-440-0x000000007FDE0000-0x000000007FE49000-memory.dmp

          Filesize

          420KB

        • memory/408-441-0x0000000000400000-0x0000000000439000-memory.dmp

          Filesize

          228KB

        • memory/408-568-0x0000000002970000-0x0000000002A28000-memory.dmp

          Filesize

          736KB