Analysis
-
max time kernel
8s -
max time network
9s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
01-03-2024 00:32
Behavioral task
behavioral1
Sample
afdc983a14af2ea2ad81e132c0e36784.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
afdc983a14af2ea2ad81e132c0e36784.exe
Resource
win10v2004-20240226-en
Errors
General
-
Target
afdc983a14af2ea2ad81e132c0e36784.exe
-
Size
618KB
-
MD5
afdc983a14af2ea2ad81e132c0e36784
-
SHA1
efff0f2da5033dcbf0916b6e8e37ed9ac7afc78a
-
SHA256
eb3218febf123db48ce4b1c1e9b193d50e3756ee1d8353e5511399901cedfbe6
-
SHA512
2e662743ef31e6f167606621a495d4c02ea49c1f23e28781189e37cdc09e0add83b910a400808d3943e69eab143a6642f1b81a26891a1f56aaf562f70b7bdea6
-
SSDEEP
12288:DqjENgTj2zya6WUAz0mjvFsUSd8uONjFL+KTKSPswmadW4kJQXRD:DRLUs0m7OzuuOOKTfPBkiBD
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\gog.exe" afdc983a14af2ea2ad81e132c0e36784.exe -
Processes:
resource yara_rule behavioral1/memory/1976-0-0x0000000000400000-0x000000000057F000-memory.dmp upx behavioral1/memory/1976-5-0x0000000000400000-0x000000000057F000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
afdc983a14af2ea2ad81e132c0e36784.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum afdc983a14af2ea2ad81e132c0e36784.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 afdc983a14af2ea2ad81e132c0e36784.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 57 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exepid process 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exedescription pid process Token: SeShutdownPrivilege 1976 afdc983a14af2ea2ad81e132c0e36784.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exepid process 1976 afdc983a14af2ea2ad81e132c0e36784.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exepid process 1976 afdc983a14af2ea2ad81e132c0e36784.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exepid process 1976 afdc983a14af2ea2ad81e132c0e36784.exe 1976 afdc983a14af2ea2ad81e132c0e36784.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\afdc983a14af2ea2ad81e132c0e36784.exe"C:\Users\Admin\AppData\Local\Temp\afdc983a14af2ea2ad81e132c0e36784.exe"1⤵
- Modifies WinLogon for persistence
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1976-0-0x0000000000400000-0x000000000057F000-memory.dmpFilesize
1.5MB
-
memory/1976-1-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1976-5-0x0000000000400000-0x000000000057F000-memory.dmpFilesize
1.5MB
-
memory/2432-6-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/2560-4-0x0000000002D90000-0x0000000002D91000-memory.dmpFilesize
4KB