Analysis
-
max time kernel
145s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
20/01/2024, 10:13
Static task
static1
Behavioral task
behavioral1
Sample
6a27d634d60cf8f2b9271c185cf76da2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6a27d634d60cf8f2b9271c185cf76da2.exe
Resource
win10v2004-20231222-en
General
-
Target
6a27d634d60cf8f2b9271c185cf76da2.exe
-
Size
1.3MB
-
MD5
6a27d634d60cf8f2b9271c185cf76da2
-
SHA1
ac96a1b10ce298ee5b2a95fdf3a2eeaf200ed3b0
-
SHA256
1d2e094fb574bb2d941f69394e1324fce3247cdfa8c5e09fee9c18a906b1e88d
-
SHA512
9e348a29794381ac72ca20eb72f32c1f02d49011296c472e273287187364a77453573753422eed0b3f1c073b6981376474353d25b9977511622a4de1c021cdaa
-
SSDEEP
24576:MdwQH6icoECFpWylHAy8IYQoRJCSrG1mxMJaFjEx4AFcxsv:YluoE0pWylgy8DQozCcycMJJxtFciv
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" 6a27d634d60cf8f2b9271c185cf76da2.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 6a27d634d60cf8f2b9271c185cf76da2.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" 6a27d634d60cf8f2b9271c185cf76da2.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" notepad.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3572 set thread context of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 5036 set thread context of 880 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 92 -
Program crash 2 IoCs
pid pid_target Process procid_target 4880 880 WerFault.exe 92 4504 880 WerFault.exe 92 -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 6a27d634d60cf8f2b9271c185cf76da2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 6a27d634d60cf8f2b9271c185cf76da2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 6a27d634d60cf8f2b9271c185cf76da2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 6a27d634d60cf8f2b9271c185cf76da2.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 6a27d634d60cf8f2b9271c185cf76da2.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeSecurityPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeTakeOwnershipPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeLoadDriverPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeSystemProfilePrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeSystemtimePrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeProfSingleProcessPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeIncBasePriorityPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeCreatePagefilePrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeBackupPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeRestorePrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeShutdownPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeDebugPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeSystemEnvironmentPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeChangeNotifyPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeRemoteShutdownPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeUndockPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeManageVolumePrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeImpersonatePrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: SeCreateGlobalPrivilege 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: 33 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: 34 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: 35 5036 6a27d634d60cf8f2b9271c185cf76da2.exe Token: 36 5036 6a27d634d60cf8f2b9271c185cf76da2.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 3572 6a27d634d60cf8f2b9271c185cf76da2.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 3572 wrote to memory of 5036 3572 6a27d634d60cf8f2b9271c185cf76da2.exe 90 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 4548 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 93 PID 5036 wrote to memory of 880 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 92 PID 5036 wrote to memory of 880 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 92 PID 5036 wrote to memory of 880 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 92 PID 5036 wrote to memory of 880 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 92 PID 5036 wrote to memory of 880 5036 6a27d634d60cf8f2b9271c185cf76da2.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\6a27d634d60cf8f2b9271c185cf76da2.exe"C:\Users\Admin\AppData\Local\Temp\6a27d634d60cf8f2b9271c185cf76da2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\6a27d634d60cf8f2b9271c185cf76da2.exeC:\Users\Admin\AppData\Local\Temp\6a27d634d60cf8f2b9271c185cf76da2.exe2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵PID:880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 4244⤵
- Program crash
PID:4880
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 880 -s 4284⤵
- Program crash
PID:4504
-
-
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
PID:4548
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 880 -ip 8801⤵PID:3104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 880 -ip 8801⤵PID:3044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
551KB
MD56645f3c89747d9bc1431e3f1e63d180e
SHA15961aae00e2704c2990f9f82949800fc8d942b46
SHA256b141f1846303e0e06b25b39a11e964ea4dfcd4ef2a213fce562ac85e7465faf3
SHA5126b0650c162cfe853782d0f6ea486a76adbb5cf612bfc2cbcdf920bd85a3e5f67ac988afa7acf848a2cc0f4489618f59fc965b0687e1e742cc0f6b859ec2debc1
-
Filesize
570KB
MD54e6007d7c78943ebac012ffea154fc6f
SHA1819497a5d71304194804b7e83d88b84815ca796e
SHA256478cf4e506d591245aa432fe7bd743753b78f9f62efa7c53a3fcb6a4d8719b85
SHA5127d6b2acebc2455f755ca7a5adf00ab716e15039a97c1009360f0a205d3907991a7e1e12d49eb8b90797b9e60d5106b68dfd0312f129c1c01952269ee17aee453