Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-02-2024 16:10

General

  • Target

    8751033a7635d5292ee6acf6b7ce070b.exe

  • Size

    255KB

  • MD5

    8751033a7635d5292ee6acf6b7ce070b

  • SHA1

    043e6703de1bb3b80da086c3170a3a32ff0daa75

  • SHA256

    187af94549eb0421867470da250a14ad73e30252b91352a9a152fd55f2559eb9

  • SHA512

    1e01f144893dbcd157fbc560a9faa054c947b77667b7ad761888035a3930c24e4eaf84a1de18f1d5808d25ea97a32aa80cd0a0147c6d83774cdad876c3430188

  • SSDEEP

    6144:nNU2+2kcTBWUZxjCld3hRV2QsXSAaj4ijpFaQTQisa:nNRdpgdRRoTCD4ijpoix

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Modifies WinLogon 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8751033a7635d5292ee6acf6b7ce070b.exe
    "C:\Users\Admin\AppData\Local\Temp\8751033a7635d5292ee6acf6b7ce070b.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Adds Run key to start application
    • Modifies WinLogon
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3108

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3108-0-0x0000000000400000-0x0000000000533000-memory.dmp

    Filesize

    1.2MB

  • memory/3108-1-0x00000000009A0000-0x00000000009F7000-memory.dmp

    Filesize

    348KB

  • memory/3108-2-0x0000000000400000-0x0000000000533000-memory.dmp

    Filesize

    1.2MB

  • memory/3108-4-0x0000000002740000-0x00000000027F2000-memory.dmp

    Filesize

    712KB

  • memory/3108-5-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-7-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-11-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-10-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-8-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-63-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-70-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-71-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-75-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-85-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-86-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-88-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-91-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-89-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-97-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-100-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-99-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-105-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-102-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-96-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-108-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-109-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-113-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-111-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-94-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-69-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-68-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-67-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-66-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-65-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-64-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-62-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-61-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-60-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-59-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-58-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB

  • memory/3108-4223-0x00000000009A0000-0x00000000009F7000-memory.dmp

    Filesize

    348KB

  • memory/3108-5000-0x0000000000400000-0x0000000000533000-memory.dmp

    Filesize

    1.2MB

  • memory/3108-6196-0x0000000002900000-0x00000000029B8000-memory.dmp

    Filesize

    736KB