Analysis
-
max time kernel
10s -
max time network
11s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2024 23:26
Behavioral task
behavioral1
Sample
8123baa476516a50e29b32ea0ce7314d.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8123baa476516a50e29b32ea0ce7314d.exe
Resource
win10v2004-20231222-en
Errors
General
-
Target
8123baa476516a50e29b32ea0ce7314d.exe
-
Size
596KB
-
MD5
8123baa476516a50e29b32ea0ce7314d
-
SHA1
274bf9fc63b32e1cfa862ed55cbdb5835850c54b
-
SHA256
ecd76aed11be0a866826e5ef226316ccfa0d6e1f70a154418f51acb75fcb7909
-
SHA512
3124819c73f7660b5ac71ddee98dca5d7122ad1591454727f57506fe7a80e493e780c12cdb272761ceaf25871d0f7dddc9ccc4defc1735db0eaaa9665cd59968
-
SSDEEP
12288:Us0efPTb449JQ/rjc15o+t47yr8vWLDmlse7cp3SlEOXoFKl2okeL:T0MPTbT9yT+/foy6K0cdSlEVO2te
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
8123baa476516a50e29b32ea0ce7314d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\gog.exe" 8123baa476516a50e29b32ea0ce7314d.exe -
Processes:
resource yara_rule behavioral2/memory/4032-0-0x0000000000400000-0x0000000000571000-memory.dmp upx behavioral2/memory/4032-4-0x0000000000400000-0x0000000000571000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
8123baa476516a50e29b32ea0ce7314d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum 8123baa476516a50e29b32ea0ce7314d.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 8123baa476516a50e29b32ea0ce7314d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "248" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8123baa476516a50e29b32ea0ce7314d.exepid process 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8123baa476516a50e29b32ea0ce7314d.exedescription pid process Token: SeShutdownPrivilege 4032 8123baa476516a50e29b32ea0ce7314d.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
8123baa476516a50e29b32ea0ce7314d.exepid process 4032 8123baa476516a50e29b32ea0ce7314d.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
8123baa476516a50e29b32ea0ce7314d.exepid process 4032 8123baa476516a50e29b32ea0ce7314d.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
8123baa476516a50e29b32ea0ce7314d.exeLogonUI.exepid process 4032 8123baa476516a50e29b32ea0ce7314d.exe 4032 8123baa476516a50e29b32ea0ce7314d.exe 5160 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8123baa476516a50e29b32ea0ce7314d.exe"C:\Users\Admin\AppData\Local\Temp\8123baa476516a50e29b32ea0ce7314d.exe"1⤵
- Modifies WinLogon for persistence
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39a8055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx