Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06-02-2024 17:38
Behavioral task
behavioral1
Sample
9516e821cbac3a3c46fa6de3143eb7c9.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
9516e821cbac3a3c46fa6de3143eb7c9.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
9516e821cbac3a3c46fa6de3143eb7c9.exe
-
Size
37KB
-
MD5
9516e821cbac3a3c46fa6de3143eb7c9
-
SHA1
c987a6433441f3a0258d25da6183752496624e58
-
SHA256
c8f85f0f5ea1105e88df6bf2b77c80ed9971af9c47d58c96566fbdb08d883033
-
SHA512
1400ebcc1e1fda3622f114fba2079185b8c4bf7d27dc00eb6bd8f78400783ffe575b2408f804682b5c34f970ce599617000b79509dc541fdcc4841a9a13a041b
-
SSDEEP
768:QlbdBEcYRNzNBMl8BjWsYs02PrEi+nt6SYDhNa:adBYIl8BqW+nt6Sga
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
9516e821cbac3a3c46fa6de3143eb7c9.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\ProgramData\\22CC6C32.exe" 9516e821cbac3a3c46fa6de3143eb7c9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\ProgramData\\22CC6C32.exe" 9516e821cbac3a3c46fa6de3143eb7c9.exe -
Processes:
resource yara_rule behavioral1/memory/1992-0-0x0000000000400000-0x0000000000419000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9516e821cbac3a3c46fa6de3143eb7c9.exepid process 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe 1992 9516e821cbac3a3c46fa6de3143eb7c9.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1992-0-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1992-1-0x00000000001C0000-0x00000000001C3000-memory.dmpFilesize
12KB
-
memory/1992-3-0x0000000000400000-0x0000000000419000-memory.dmpFilesize
100KB
-
memory/1992-5-0x00000000001C0000-0x00000000001C3000-memory.dmpFilesize
12KB