460a3e3a039c2d0bb2c76017b41403bf3e92727269f49b08778d33108278b58f

Analysis

max time kernel
1190s
max time network
1158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 11:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

[email protected]
Size

116KB
MD5

41789c704a0eecfdd0048b4b4193e752
SHA1

fb1e8385691fa3293b7cbfb9b2656cf09f20e722
SHA256

b2dcfdf9e7b09f2aa5004668370e77982963ace820e7285b2e264a294441da23
SHA512

76391ac85fdc3be75441fcd6e19bed08b807d3946c7281c647f16a3be5388f7be307e6323fac8502430a4a6d800d52a88709592a49011ecc89de4f19102435ea
SSDEEP

3072:pYV/aVHN9ySTn34w33FVTyuGAxsvBLSqAKZqoqrxy031l3y:8adNlltyu3Pa5gr33

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\[email protected]"	[email protected]

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3656-0-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/3656-2-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/3656-4-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral1/memory/3656-5-0x0000000000400000-0x0000000000438000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system = "C:\\Users\\Admin\\AppData\\Local\\Temp\\[email protected]"	[email protected]

Kills process with taskkill 1 IoCs

evasion

pid	Process
4648	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000_Classes\Local Settings\MuiCache	SearchApp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4648	taskkill.exe
Token: SeManageVolumePrivilege	1608	svchost.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 4648	3656	[email protected]	89
PID 3656 wrote to memory of 4648	3656	[email protected]	89
PID 3656 wrote to memory of 4648	3656	[email protected]	89

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /F /IM explorer.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4648

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
- Modifies registry class
PID:3852

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:3024

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133543719110491808.txt

Filesize
74KB

MD5
80dffedad36ef4c303579f8c9be9dbd7

SHA1
792ca2a83d616ca82d973ece361ed9e95c95a0d8

SHA256
590ca4d2f62a7864a62ccb1075c55191f7f9d5c5304ea3446961bb50f9e3916e

SHA512
826b97a4de7c765f8f5ebc520960f68381fd9f4bfe68c2fbe46c6118110c9c14a87dcb8ed8102e60a954b4b3c408f72e7a93fd96317be3d51120a2ddd2faa3ea

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat

Filesize
16KB

MD5
10391a2e922a9d1b21cb2a85aba4ba16

SHA1
44ec2bc6067b75fa87e489560fb9b25336d524ac

SHA256
9ca0365c41b231ffd8dce02bd4f1596df89150d69a97e30dfe347a13863e7ce6

SHA512
5a646d73b3c64c3cd767a883e4a0f635ef38e0da8cd9465662bac73a9773240f36977a4971671ca8cb314063e226c803796181f3ea2b98eca2cba32d6ed0f949

Download Submit
memory/1608-36-0x00000284C1460000-0x00000284C1470000-memory.dmp

Filesize
64KB

Download
memory/1608-52-0x00000284C1560000-0x00000284C1570000-memory.dmp

Filesize
64KB

Download
memory/3656-0-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3656-1-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/3656-2-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3656-4-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3656-5-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads