Analysis
-
max time kernel
8s -
max time network
8s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18-01-2024 07:24
Behavioral task
behavioral1
Sample
64d022610279d7ee7fd15d7fbf0c55f3.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
64d022610279d7ee7fd15d7fbf0c55f3.exe
Resource
win10v2004-20231222-en
Errors
General
-
Target
64d022610279d7ee7fd15d7fbf0c55f3.exe
-
Size
596KB
-
MD5
64d022610279d7ee7fd15d7fbf0c55f3
-
SHA1
11f4a34a1c24a6a7872af20640f9d19742060638
-
SHA256
2c6f5c04a26498cd4de1bb895fd6bcf143a0d264c19b4392499b0f3929ef4d24
-
SHA512
afd259df591348212179a836efa402d7417247b38cc673160c4d48ddd27da4a16fc744d4e7a0a454d852d5d74ff5b61dc1b540ec0c7cfd3b09f87fc847bfae78
-
SSDEEP
12288:VqjENgTj2zya6WUAz0mjvFsUSd8uON3rJe7CVeXq9uN58Kc2M6:VRLUs0m7OzuuOprweQX98Kc2N
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
64d022610279d7ee7fd15d7fbf0c55f3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\gog.exe" 64d022610279d7ee7fd15d7fbf0c55f3.exe -
Processes:
resource yara_rule behavioral1/memory/1972-0-0x0000000000400000-0x0000000000573000-memory.dmp upx behavioral1/memory/1972-4-0x0000000000400000-0x0000000000573000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
64d022610279d7ee7fd15d7fbf0c55f3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 64d022610279d7ee7fd15d7fbf0c55f3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 64d022610279d7ee7fd15d7fbf0c55f3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
64d022610279d7ee7fd15d7fbf0c55f3.exepid process 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
64d022610279d7ee7fd15d7fbf0c55f3.exedescription pid process Token: SeShutdownPrivilege 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
64d022610279d7ee7fd15d7fbf0c55f3.exepid process 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
64d022610279d7ee7fd15d7fbf0c55f3.exepid process 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
64d022610279d7ee7fd15d7fbf0c55f3.exepid process 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe 1972 64d022610279d7ee7fd15d7fbf0c55f3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64d022610279d7ee7fd15d7fbf0c55f3.exe"C:\Users\Admin\AppData\Local\Temp\64d022610279d7ee7fd15d7fbf0c55f3.exe"1⤵
- Modifies WinLogon for persistence
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1972-0-0x0000000000400000-0x0000000000573000-memory.dmpFilesize
1.4MB
-
memory/1972-1-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1972-4-0x0000000000400000-0x0000000000573000-memory.dmpFilesize
1.4MB
-
memory/2612-6-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/2720-5-0x0000000002D90000-0x0000000002D91000-memory.dmpFilesize
4KB