Overview
overview
7Static
static
5599151.301...39.lnk
windows7-x64
5599151.301...39.lnk
windows10-2004-x64
7TUP3298063...ed.dll
windows7-x64
3TUP3298063...ed.dll
windows10-2004-x64
TUP3298063...on.dll
windows7-x64
1TUP3298063...on.dll
windows10-2004-x64
1TUP3298063...on.exe
windows7-x64
3TUP3298063...on.exe
windows10-2004-x64
3TUP3298063...n1.exe
windows7-x64
TUP3298063...n1.exe
windows10-2004-x64
TUP3298063...1_.ps1
windows7-x64
1TUP3298063...1_.ps1
windows10-2004-x64
1TUP3298063...32.dll
windows7-x64
1TUP3298063...32.dll
windows10-2004-x64
1TUP3298063...33.dll
windows7-x64
1TUP3298063...33.dll
windows10-2004-x64
1Analysis
-
max time kernel
33s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 14:22
Static task
static1
Behavioral task
behavioral1
Sample
599151.301.25077.7868139.lnk
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
599151.301.25077.7868139.lnk
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
TUP32980638916Y/ctfmon-dll-decoded.dll
Resource
win7-20240319-en
windows7-x64
Behavioral task
behavioral4
Sample
TUP32980638916Y/ctfmon-dll-decoded.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
TUP32980638916Y/ctfmon.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
TUP32980638916Y/ctfmon.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
TUP32980638916Y/ctfmon.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
TUP32980638916Y/ctfmon.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
TUP32980638916Y/ctfmon1.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
TUP32980638916Y/ctfmon1.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
TUP32980638916Y/ctfmon1_.ps1
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
TUP32980638916Y/ctfmon1_.ps1
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
TUP32980638916Y/log32.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
TUP32980638916Y/log32.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
TUP32980638916Y/log33.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral16
Sample
TUP32980638916Y/log33.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Errors
General
-
Target
TUP32980638916Y/ctfmon1.exe
-
Size
870KB
-
MD5
82d2590bfa019845cbdd670427d31674
-
SHA1
5b96ae15e9d3e0db2ebd4d94c930a39bf1829afe
-
SHA256
7d361e62e333b2ed467505025fd04c75b63c6aca9b15dad6f76adc8bd1deadbd
-
SHA512
8d071e78cf1db6d8391b567e64a04e42fd0b83bab3b2d3af729899b41a92cb7068576914a63fbbd3af3601d74a49e9620bab0a6788c13d4dad6319ce837380ee
-
SSDEEP
24576:FAHnh+eWsN3skA4RV1Hom2KXMmHahM065:0h+ZkldoPK8YahY
Malware Config
Signatures
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "221" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4328 dllhost.exe 4328 dllhost.exe 4328 dllhost.exe 4328 dllhost.exe 4328 dllhost.exe 4328 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 5980 shutdown.exe Token: SeRemoteShutdownPrivilege 5980 shutdown.exe Token: SeShutdownPrivilege 5956 shutdown.exe Token: SeRemoteShutdownPrivilege 5956 shutdown.exe Token: SeShutdownPrivilege 1012 shutdown.exe Token: SeRemoteShutdownPrivilege 1012 shutdown.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2528 ctfmon1.exe 2528 ctfmon1.exe 2528 ctfmon1.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2528 ctfmon1.exe 2528 ctfmon1.exe 2528 ctfmon1.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 6064 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94 PID 2528 wrote to memory of 4328 2528 ctfmon1.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\TUP32980638916Y\ctfmon1.exe"C:\Users\Admin\AppData\Local\Temp\TUP32980638916Y\ctfmon1.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4328 -
C:\Windows\SysWOW64\cmd.execmd /c shutdown -s -t 2 -f3⤵PID:1068
-
C:\Windows\SysWOW64\shutdown.exeshutdown -s -t 2 -f4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5956
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c shutdown -s -t 2 -f3⤵PID:5660
-
C:\Windows\SysWOW64\shutdown.exeshutdown -s -t 2 -f4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5980
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c shutdown -s -t 1 -f3⤵PID:5684
-
C:\Windows\SysWOW64\shutdown.exeshutdown -s -t 1 -f4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1012
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3990855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6064