Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/05/2024, 21:45

General

  • Target

    4f25521315223fe8def008cedb40073f18f21608d6bb41739d30988eefff4cf9.exe

  • Size

    212KB

  • MD5

    5e556d0847905125d4c474d153c5ee37

  • SHA1

    272b80004a631d63854404ef47e57f9fbd307e70

  • SHA256

    4f25521315223fe8def008cedb40073f18f21608d6bb41739d30988eefff4cf9

  • SHA512

    f2a2aca022ecf559566464ca0c20257a99f0ea5f56dd84b7ce610cae436ea4d9af1fc451753d4aa876d260b7b0ab131dbf03c2cab1c3885f5f3da5d8b44b6da5

  • SSDEEP

    6144:zxNqLW6opBZMU/y/JEGjg+op2BSNCCr7/jU:tA6NBT/yEGjWwa7vU

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon 2 TTPs 1 IoCs
  • Drops file in Program Files directory 18 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4f25521315223fe8def008cedb40073f18f21608d6bb41739d30988eefff4cf9.exe
    "C:\Users\Admin\AppData\Local\Temp\4f25521315223fe8def008cedb40073f18f21608d6bb41739d30988eefff4cf9.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JQ5FYD87\login[1].htm

    Filesize

    168B

    MD5

    d57e3a550060f85d44a175139ea23021

    SHA1

    2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

    SHA256

    43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

    SHA512

    0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\IE\JQ5FYD87\login[2].htm

    Filesize

    167B

    MD5

    0104c301c5e02bd6148b8703d19b3a73

    SHA1

    7436e0b4b1f8c222c38069890b75fa2baf9ca620

    SHA256

    446a6087825fa73eadb045e5a2e9e2adf7df241b571228187728191d961dda1f

    SHA512

    84427b656a6234a651a6d8285c103645b861a18a6c5af4abb5cb4f3beb5a4f0df4a74603a0896c7608790fbb886dc40508e92d5709f44dca05dd46c8316d15bf

  • C:\Windows\apppatch\svchost.exe

    Filesize

    212KB

    MD5

    18047627383252c1d9ea697f29c0894e

    SHA1

    0b5ec4a96d0a54eebc23110944df6064473a3f44

    SHA256

    1b39a0d09edbcebac7c9ede44002e91a63a6c6983ed80326cc76711d43f1ec94

    SHA512

    b7dc46db0e68d8078045980f70c623ac7929223a69dab7100311a9e87d6559a345ffa6847b857bfc2c0c6dc7832839629ed04ad0060742d440cff563034732d6

  • memory/1712-0-0x0000000002210000-0x0000000002262000-memory.dmp

    Filesize

    328KB

  • memory/1712-1-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1712-12-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/1712-15-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/1712-14-0x0000000002210000-0x0000000002262000-memory.dmp

    Filesize

    328KB

  • memory/3468-16-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/3468-17-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/3468-18-0x0000000002490000-0x000000000253A000-memory.dmp

    Filesize

    680KB

  • memory/3468-21-0x0000000000400000-0x000000000049A000-memory.dmp

    Filesize

    616KB

  • memory/3468-19-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-22-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-24-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-79-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-81-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-80-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-78-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-76-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-75-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-74-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-73-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-72-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-71-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-70-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-69-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-68-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-67-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-66-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-65-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-64-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-63-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-61-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-60-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-59-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-58-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-57-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-56-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-55-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-54-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-53-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-52-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-51-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-50-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-49-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-48-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-47-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-46-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-44-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-43-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-42-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-41-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-40-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-39-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-37-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-36-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-35-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-33-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-34-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-32-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-31-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-29-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-28-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-27-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-26-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-25-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-77-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-62-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-45-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-38-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB

  • memory/3468-30-0x0000000002C40000-0x0000000002CF7000-memory.dmp

    Filesize

    732KB