Analysis
-
max time kernel
0s -
max time network
10s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18-01-2024 07:24
Behavioral task
behavioral1
Sample
64d022610279d7ee7fd15d7fbf0c55f3.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
64d022610279d7ee7fd15d7fbf0c55f3.exe
Resource
win10v2004-20231222-en
Errors
General
-
Target
64d022610279d7ee7fd15d7fbf0c55f3.exe
-
Size
596KB
-
MD5
64d022610279d7ee7fd15d7fbf0c55f3
-
SHA1
11f4a34a1c24a6a7872af20640f9d19742060638
-
SHA256
2c6f5c04a26498cd4de1bb895fd6bcf143a0d264c19b4392499b0f3929ef4d24
-
SHA512
afd259df591348212179a836efa402d7417247b38cc673160c4d48ddd27da4a16fc744d4e7a0a454d852d5d74ff5b61dc1b540ec0c7cfd3b09f87fc847bfae78
-
SSDEEP
12288:VqjENgTj2zya6WUAz0mjvFsUSd8uON3rJe7CVeXq9uN58Kc2M6:VRLUs0m7OzuuOprweQX98Kc2N
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
64d022610279d7ee7fd15d7fbf0c55f3.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\gog.exe" 64d022610279d7ee7fd15d7fbf0c55f3.exe -
Processes:
resource yara_rule behavioral2/memory/4876-0-0x0000000000400000-0x0000000000573000-memory.dmp upx behavioral2/memory/4876-4-0x0000000000400000-0x0000000000573000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
64d022610279d7ee7fd15d7fbf0c55f3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 64d022610279d7ee7fd15d7fbf0c55f3.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 64d022610279d7ee7fd15d7fbf0c55f3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
64d022610279d7ee7fd15d7fbf0c55f3.exedescription pid process Token: SeShutdownPrivilege 4876 64d022610279d7ee7fd15d7fbf0c55f3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\64d022610279d7ee7fd15d7fbf0c55f3.exe"C:\Users\Admin\AppData\Local\Temp\64d022610279d7ee7fd15d7fbf0c55f3.exe"1⤵
- Modifies WinLogon for persistence
- Maps connected drives based on registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3944855 /state1:0x41c64e6d1⤵