Overview
overview
7Static
static
5599151.301...39.lnk
windows7-x64
5599151.301...39.lnk
windows10-2004-x64
7TUP3298063...ed.dll
windows7-x64
3TUP3298063...ed.dll
windows10-2004-x64
TUP3298063...on.dll
windows7-x64
1TUP3298063...on.dll
windows10-2004-x64
1TUP3298063...on.exe
windows7-x64
3TUP3298063...on.exe
windows10-2004-x64
3TUP3298063...n1.exe
windows7-x64
TUP3298063...n1.exe
windows10-2004-x64
TUP3298063...1_.ps1
windows7-x64
1TUP3298063...1_.ps1
windows10-2004-x64
1TUP3298063...32.dll
windows7-x64
1TUP3298063...32.dll
windows10-2004-x64
1TUP3298063...33.dll
windows7-x64
1TUP3298063...33.dll
windows10-2004-x64
1Analysis
-
max time kernel
15s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 14:22
Static task
static1
Behavioral task
behavioral1
Sample
599151.301.25077.7868139.lnk
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
599151.301.25077.7868139.lnk
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
TUP32980638916Y/ctfmon-dll-decoded.dll
Resource
win7-20240319-en
windows7-x64
Behavioral task
behavioral4
Sample
TUP32980638916Y/ctfmon-dll-decoded.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
TUP32980638916Y/ctfmon.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
TUP32980638916Y/ctfmon.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
TUP32980638916Y/ctfmon.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
TUP32980638916Y/ctfmon.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
TUP32980638916Y/ctfmon1.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
TUP32980638916Y/ctfmon1.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
TUP32980638916Y/ctfmon1_.ps1
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
TUP32980638916Y/ctfmon1_.ps1
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
TUP32980638916Y/log32.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral14
Sample
TUP32980638916Y/log32.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
TUP32980638916Y/log33.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral16
Sample
TUP32980638916Y/log33.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Errors
General
-
Target
TUP32980638916Y/ctfmon-dll-decoded.dll
-
Size
182KB
-
MD5
23b14120aecb4d67d836727c729340d9
-
SHA1
225be6cc75963513c72b394180a1bdb5418d9a06
-
SHA256
4af123558afa33de6944a4766fc63c6ed31b661cda5a1162f89e8f1edec0b0fa
-
SHA512
9be95e1e489e92967de883bbdf4512b2c9da556958f12d9c3c516bf6d5115c60a6d2a0549b9c0ca5b5c600ae213bd410e8273eecaea334025b591cc4779f96f6
-
SSDEEP
1536:leKfXcBeQXiQrJY+Brkk53AgZeOGTlbR30oNdJWc6FPfwnS3c1NwGqbQMgsjinUI:gKd8OMIOGMEnYs0iIVZuqDSo7Cp
Malware Config
Signatures
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "30" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4040 dllhost.exe 4040 dllhost.exe 4040 dllhost.exe 4040 dllhost.exe 4040 dllhost.exe 4040 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeShutdownPrivilege 5960 shutdown.exe Token: SeRemoteShutdownPrivilege 5960 shutdown.exe Token: SeShutdownPrivilege 5976 shutdown.exe Token: SeRemoteShutdownPrivilege 5976 shutdown.exe Token: SeShutdownPrivilege 5968 shutdown.exe Token: SeRemoteShutdownPrivilege 5968 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5244 LogonUI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4652 wrote to memory of 2728 4652 rundll32.exe 85 PID 4652 wrote to memory of 2728 4652 rundll32.exe 85 PID 4652 wrote to memory of 2728 4652 rundll32.exe 85 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87 PID 2728 wrote to memory of 4040 2728 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TUP32980638916Y\ctfmon-dll-decoded.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\TUP32980638916Y\ctfmon-dll-decoded.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040 -
C:\Windows\SysWOW64\cmd.execmd /c shutdown -s -t 2 -f4⤵PID:5776
-
C:\Windows\SysWOW64\shutdown.exeshutdown -s -t 2 -f5⤵
- Suspicious use of AdjustPrivilegeToken
PID:5960
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c shutdown -s -t 2 -f4⤵PID:5792
-
C:\Windows\SysWOW64\shutdown.exeshutdown -s -t 2 -f5⤵
- Suspicious use of AdjustPrivilegeToken
PID:5976
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c shutdown -s -t 1 -f4⤵PID:5800
-
C:\Windows\SysWOW64\shutdown.exeshutdown -s -t 1 -f5⤵
- Suspicious use of AdjustPrivilegeToken
PID:5968
-
-
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3987855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5244