d24c6caf8f1487c75ffe5cace014f15f122b4d737584fbf8b8e25b2c0b88dab2

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d24c6caf8f1487c75ffe5cace014f15f122b4d737584fbf8b8e25b2c0b88dab2.exe
Size

75KB
MD5

96b9c75b5ba24150df6c999c9870fddf
SHA1

80b0c4f478667c9f75618c0adcc0615106359ce4
SHA256

d24c6caf8f1487c75ffe5cace014f15f122b4d737584fbf8b8e25b2c0b88dab2
SHA512

59b8c28d4a84315a6c90ecc2e9363c296a380ddd7fc03471010c1ce08eacedf152cb54375c7c3bf4d4b4fe27ba98ce277e79d07944d46e7aa0378941e58c05bb
SSDEEP

1536:kP6RJLbSshapMJgK+hxaZUux1imfJPtOrqm1s/XZydS:06RJz25KnZFvVfJPtOrqm2/XZuS

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
212	winlgon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	d24c6caf8f1487c75ffe5cace014f15f122b4d737584fbf8b8e25b2c0b88dab2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	d24c6caf8f1487c75ffe5cace014f15f122b4d737584fbf8b8e25b2c0b88dab2.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3612	212	WerFault.exe	83
3384	212	WerFault.exe	83
3400	1084	WerFault.exe	82

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1084	d24c6caf8f1487c75ffe5cace014f15f122b4d737584fbf8b8e25b2c0b88dab2.exe
212	winlgon.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1084 wrote to memory of 212	1084	d24c6caf8f1487c75ffe5cace014f15f122b4d737584fbf8b8e25b2c0b88dab2.exe	83
PID 1084 wrote to memory of 212	1084	d24c6caf8f1487c75ffe5cace014f15f122b4d737584fbf8b8e25b2c0b88dab2.exe	83
PID 1084 wrote to memory of 212	1084	d24c6caf8f1487c75ffe5cace014f15f122b4d737584fbf8b8e25b2c0b88dab2.exe	83

C:\Users\Admin\AppData\Local\Temp\d24c6caf8f1487c75ffe5cace014f15f122b4d737584fbf8b8e25b2c0b88dab2.exe
"C:\Users\Admin\AppData\Local\Temp\d24c6caf8f1487c75ffe5cace014f15f122b4d737584fbf8b8e25b2c0b88dab2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- \??\c:\users\admin\appdata\local\temp\winlgon.exe
  c:\users\admin\appdata\local\temp\winlgon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:212
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 684
    3⤵
    - Program crash
    PID:3612
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 212 -s 696
    3⤵
    - Program crash
    PID:3384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1084 -s 592
  2⤵
  - Program crash
  PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 212 -ip 212
1⤵
PID:2724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 212 -ip 212
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1084 -ip 1084
1⤵
PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\winlgon.exe

Filesize
75KB

MD5
06b1047f6c83b83e0f4c7bbfd033b118

SHA1
52d44fdb3a501a667f33651bfc4366c3264aeac9

SHA256
adc7123e01499a2bf6aebea8111c3f004202d55921528dcc085923ac89b60190

SHA512
6dd4f4dc367fe034d82c50bad0683a76f380d2d453a5d7d11656d5875cdd37241ec47c4efcd7b47ae540c832712d2215e003e70a759df1340943c62f35590509

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads