Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:03
Static task
static1
Behavioral task
behavioral1
Sample
750a8e877ded6c0d530b69fc0bd29849.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
750a8e877ded6c0d530b69fc0bd29849.exe
Resource
win10v2004-20231222-en
General
-
Target
750a8e877ded6c0d530b69fc0bd29849.exe
-
Size
257KB
-
MD5
750a8e877ded6c0d530b69fc0bd29849
-
SHA1
792daf6eb23c028db67b4fd53bf89242c6228e14
-
SHA256
27c2601bd94650517f06ca1863f9e2bf1c7859a7bf61859836a26867196552f6
-
SHA512
1476a2c3684513bd89f22ec4ea69196f3ad13e3a85aa69ee8df173801d877f0f755c18dd72cfe37bbba7e77aedc5ee065dcb7a72218ad156a1517993f08b053f
-
SSDEEP
6144:snhPrfhPgYxuaMVmaho0+tq/pTNfXwysBVe+xMXQyWIf8kPZ33yMuZixwU8:38ptqrXwy2/MXQ/EnZnBuZfL
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
750a8e877ded6c0d530b69fc0bd29849.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\750A8E~1.EXE," 750a8e877ded6c0d530b69fc0bd29849.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
750a8e877ded6c0d530b69fc0bd29849.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\750A8E~1.EXE" 750a8e877ded6c0d530b69fc0bd29849.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
750a8e877ded6c0d530b69fc0bd29849.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\e5e0da29 = "£MJM\x18(M÷\x18Ÿø±×‘\vÉ=\a y\x0f%THb\u009d5ÿϹ\u0081iµ\x17“ù6þç}-IªDÕ‰\x11°†óŠudFÂj&K\x0f!¹9aÍ;Ôèã\f¸t„>£¼ä\b\x1d§ä\x04·Œ\u008dudä\f•[EVËõ}|l»ðÈ/\x1d\r{L\x04®\x1c\x06Œn¬Dx”ý·›4¬L•”ÄF\x18³¨Œ$ôÐßOfŒm3žÅ\u008dddãlW³ÛOÝ”°ä\\\x13µ\fÍ”4½ÜèN„,·uÌÜVtÔõï\x04,L\x1c´Ž0|\fk\\\v,‹C¸W\x16\f\x1c%Ótäžó¸‹EŸeäýãÛýp\rÏöÜÇ<uøÄÕ<L\x1bÐŒÎT´X¼¼í\u00ad¼Tõ³\u008fŽ½ƒ,œ;\v\x03æàÛÝD\x1c\\€÷TS\v" 750a8e877ded6c0d530b69fc0bd29849.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\750A8E~1.EXE" 750a8e877ded6c0d530b69fc0bd29849.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
750a8e877ded6c0d530b69fc0bd29849.exepid process 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe 2004 750a8e877ded6c0d530b69fc0bd29849.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
750a8e877ded6c0d530b69fc0bd29849.exedescription pid process Token: SeSecurityPrivilege 2004 750a8e877ded6c0d530b69fc0bd29849.exe Token: SeSecurityPrivilege 2004 750a8e877ded6c0d530b69fc0bd29849.exe Token: SeSecurityPrivilege 2004 750a8e877ded6c0d530b69fc0bd29849.exe Token: SeSecurityPrivilege 2004 750a8e877ded6c0d530b69fc0bd29849.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\750a8e877ded6c0d530b69fc0bd29849.exe"C:\Users\Admin\AppData\Local\Temp\750a8e877ded6c0d530b69fc0bd29849.exe"1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2004-0-0x000000007EF40000-0x000000007EFA9000-memory.dmpFilesize
420KB
-
memory/2004-1-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/2004-3-0x0000000001E90000-0x0000000001F42000-memory.dmpFilesize
712KB
-
memory/2004-5-0x0000000001E90000-0x0000000001F42000-memory.dmpFilesize
712KB
-
memory/2004-7-0x0000000001E90000-0x0000000001F42000-memory.dmpFilesize
712KB
-
memory/2004-9-0x0000000001E90000-0x0000000001F42000-memory.dmpFilesize
712KB
-
memory/2004-11-0x0000000001E90000-0x0000000001F42000-memory.dmpFilesize
712KB
-
memory/2004-13-0x0000000001E90000-0x0000000001F42000-memory.dmpFilesize
712KB
-
memory/2004-14-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-16-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-18-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-19-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-40-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-41-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-42-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-43-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-44-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-46-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-45-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-47-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-48-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-49-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-51-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-50-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-53-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-52-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-54-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-55-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-56-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-57-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-58-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-59-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-60-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-61-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-62-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-63-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-64-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-65-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-66-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-67-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-68-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-70-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-69-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-71-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-73-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-74-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-77-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-78-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-80-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-76-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-75-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-83-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB
-
memory/2004-1419-0x000000007EF40000-0x000000007EFA9000-memory.dmpFilesize
420KB
-
memory/2004-1677-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/2004-2305-0x0000000002600000-0x00000000026B8000-memory.dmpFilesize
736KB