193ce35e09ff2ccbae58dddff060f286750c0a61cba1da6983c0d138c6ca240f

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 12:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d60ee95adae91d23da4b7196787ee37e.exe
Size

250KB
MD5

d60ee95adae91d23da4b7196787ee37e
SHA1

fe195b24f7ad7b7da5bfe25cc330cf92f8129880
SHA256

193ce35e09ff2ccbae58dddff060f286750c0a61cba1da6983c0d138c6ca240f
SHA512

efe47335bedf80408d53506b5fc73ffb96e923963473370a9bbfd4ab4f13b948dd4e26d7364f81e6f9381be14bf6aae6f57a8fc915b553fda9e29913cebc6a39
SSDEEP

6144:2cjlsubtn6BV+/1PSSggDhBkLq2pjMoyYKRKESBv:7iuZ6Bq1aMWqBTSV

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Users\\Admin\\AppData\\Local\\Temp\\D60EE9~1.EXE,"	d60ee95adae91d23da4b7196787ee37e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D60EE9~1.EXE"	d60ee95adae91d23da4b7196787ee37e.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\1314caff = "\x17k\fU@f9Ì†žã]%Œ3ÖbwmNM€ÈïhÐ‚t\x05\x1eÇ¦·‡s\u008f@d©°wFîiª¢¦kªÜ\x17\u0081{CÄÎ\x11\x19LÐ°,\x06g\a\|ÎAç„!±ï_@/\x1ay7‡!\x7fÈã\u008f£I‘IcR9¡W7\x02ü'b0\x1f\x0fOD³ŠóÂì\x1bëIw‰¿t¼0{‹W$/âÛ+\x1aû£\x12‘\x0f›Ñª\x02pi\a‰$Ï¿Œ\açÁÑù\váW8!Ù¯\x12—ü9Ñ‹IŸQ_oÇªŸ¿÷\u0081Áª\u008f/_Çßùé·—ÜÁ\x17ŸÈ9ñGØd\u0081:ª\x17‹ÏóÇ_ÄégÇ\x03`\x01<)ßyj ÂÛ{4¹BÔz\aüqcëºÉï©g\u008frDQ\b`\x13\x04—câÃyø'¯@‘ü ü‹\\Y"	d60ee95adae91d23da4b7196787ee37e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System = "C:\\Users\\Admin\\AppData\\Local\\Temp\\D60EE9~1.EXE"	d60ee95adae91d23da4b7196787ee37e.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2216	d60ee95adae91d23da4b7196787ee37e.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2216	d60ee95adae91d23da4b7196787ee37e.exe
Token: SeSecurityPrivilege	2216	d60ee95adae91d23da4b7196787ee37e.exe
Token: SeSecurityPrivilege	2216	d60ee95adae91d23da4b7196787ee37e.exe
Token: SeSecurityPrivilege	2216	d60ee95adae91d23da4b7196787ee37e.exe

C:\Users\Admin\AppData\Local\Temp\d60ee95adae91d23da4b7196787ee37e.exe
"C:\Users\Admin\AppData\Local\Temp\d60ee95adae91d23da4b7196787ee37e.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-0-0x000000007EF40000-0x000000007EFA7000-memory.dmp

Filesize
412KB

Download
memory/2216-1-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2216-3-0x0000000002420000-0x00000000024D2000-memory.dmp

Filesize
712KB

Download
memory/2216-5-0x0000000002420000-0x00000000024D2000-memory.dmp

Filesize
712KB

Download
memory/2216-7-0x0000000002420000-0x00000000024D2000-memory.dmp

Filesize
712KB

Download
memory/2216-9-0x0000000002420000-0x00000000024D2000-memory.dmp

Filesize
712KB

Download
memory/2216-13-0x0000000002420000-0x00000000024D2000-memory.dmp

Filesize
712KB

Download
memory/2216-11-0x0000000002420000-0x00000000024D2000-memory.dmp

Filesize
712KB

Download
memory/2216-14-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-16-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-17-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-19-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-20-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-23-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-22-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-24-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-25-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-26-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-27-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-28-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-31-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-30-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-29-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-32-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-33-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-34-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-35-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-36-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-38-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-37-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-39-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-40-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-41-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-42-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-43-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-44-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-45-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-47-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-48-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-46-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-51-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-53-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-52-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-50-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-49-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-55-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-54-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-56-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-59-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-58-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-61-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-60-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-64-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-65-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-66-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-67-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-68-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download
memory/2216-634-0x000000007EF40000-0x000000007EFA7000-memory.dmp

Filesize
412KB

Download
memory/2216-664-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2216-778-0x00000000025E0000-0x0000000002698000-memory.dmp

Filesize
736KB

Download