dae37f0f63896d3f34652b7a46931c70524198a791289400750abb95c052670f

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16-03-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce1039d7c289567a2869f37710a83dc4.exe
Size

320KB
MD5

ce1039d7c289567a2869f37710a83dc4
SHA1

3876f9c4f45b32420167c97c99a56dba9ed73297
SHA256

dae37f0f63896d3f34652b7a46931c70524198a791289400750abb95c052670f
SHA512

a0f8cd6f82badc59d23f6182503cdb9e662061bcac420f13443247b5bb966298ebb1cd4b1c777242d515e552c9a2d6e22655c8b593c6f355a92b94382330969f
SSDEEP

6144:sp7etHcOuTphpLTpMWKVTHdULQgk8ccm1RfwflBeHK9:U08OEDpbC98xk8PmDEfe8

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\WINDOWS\\system32\\userinit.exe,C:\\Arquivos de programas\\rS9GGlnt.exe"	ce1039d7c289567a2869f37710a83dc4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	ce1039d7c289567a2869f37710a83dc4.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	\??\c:\windows\winlogn.ini	ce1039d7c289567a2869f37710a83dc4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2464	ce1039d7c289567a2869f37710a83dc4.exe

C:\Users\Admin\AppData\Local\Temp\ce1039d7c289567a2869f37710a83dc4.exe
"C:\Users\Admin\AppData\Local\Temp\ce1039d7c289567a2869f37710a83dc4.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1316 --field-trial-handle=2272,i,17338911640954948469,1637568328132129119,262144 --variations-seed-version /prefetch:8
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2464-0-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/2464-1-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-4-0x0000000002190000-0x0000000002191000-memory.dmp

Filesize
4KB

Download
memory/2464-5-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-6-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-7-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-8-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-9-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-10-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-11-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-12-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-13-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-14-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-15-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download
memory/2464-16-0x0000000000400000-0x00000000004B0000-memory.dmp

Filesize
704KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads