Analysis
-
max time kernel
9s -
max time network
9s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-03-2024 00:32
Behavioral task
behavioral1
Sample
afdc983a14af2ea2ad81e132c0e36784.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
afdc983a14af2ea2ad81e132c0e36784.exe
Resource
win10v2004-20240226-en
Errors
General
-
Target
afdc983a14af2ea2ad81e132c0e36784.exe
-
Size
618KB
-
MD5
afdc983a14af2ea2ad81e132c0e36784
-
SHA1
efff0f2da5033dcbf0916b6e8e37ed9ac7afc78a
-
SHA256
eb3218febf123db48ce4b1c1e9b193d50e3756ee1d8353e5511399901cedfbe6
-
SHA512
2e662743ef31e6f167606621a495d4c02ea49c1f23e28781189e37cdc09e0add83b910a400808d3943e69eab143a6642f1b81a26891a1f56aaf562f70b7bdea6
-
SSDEEP
12288:DqjENgTj2zya6WUAz0mjvFsUSd8uONjFL+KTKSPswmadW4kJQXRD:DRLUs0m7OzuuOOKTfPBkiBD
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\gog.exe" afdc983a14af2ea2ad81e132c0e36784.exe -
Processes:
resource yara_rule behavioral2/memory/1564-0-0x0000000000400000-0x000000000057F000-memory.dmp upx behavioral2/memory/1564-4-0x0000000000400000-0x000000000057F000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
afdc983a14af2ea2ad81e132c0e36784.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum afdc983a14af2ea2ad81e132c0e36784.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 afdc983a14af2ea2ad81e132c0e36784.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "156" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exepid process 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exedescription pid process Token: SeShutdownPrivilege 1564 afdc983a14af2ea2ad81e132c0e36784.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exepid process 1564 afdc983a14af2ea2ad81e132c0e36784.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exepid process 1564 afdc983a14af2ea2ad81e132c0e36784.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
afdc983a14af2ea2ad81e132c0e36784.exeLogonUI.exepid process 1564 afdc983a14af2ea2ad81e132c0e36784.exe 1564 afdc983a14af2ea2ad81e132c0e36784.exe 4608 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\afdc983a14af2ea2ad81e132c0e36784.exe"C:\Users\Admin\AppData\Local\Temp\afdc983a14af2ea2ad81e132c0e36784.exe"1⤵
- Modifies WinLogon for persistence
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3950855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx