ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b

Analysis

max time kernel
134s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27-05-2024 02:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b.exe
Size

244KB
MD5

942d9072bd420ccf98627fb01076316e
SHA1

ca965922fbaa87cfd73f5888c89abfa8c6b38f4e
SHA256

ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b
SHA512

1c1f5090c3f40e379d647caefc17acbcb3ce2a67be9a9e61c0d97894e5c708ff44b88504aaf544cce5d45861722750872ea7b124f5000fa233b0d793740fc443
SSDEEP

6144:PEXlSylvFuWaS54hIAv/QhuA7HY8pPZ0FP6BzxM5EmX:wAylvv5YRwh9HYd61xhmX

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4104	svchost.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\36aafc24 = "C:\\Windows\\apppatch\\svchost.exe"	ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\36aafc24 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\apppatch\svchost.exe	ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b.exe
File created	C:\Windows\apppatch\svchost.exe	ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2576	4104	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4104	svchost.exe
4104	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2072	ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 4104	2072	ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b.exe	83
PID 2072 wrote to memory of 4104	2072	ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b.exe	83
PID 2072 wrote to memory of 4104	2072	ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b.exe	83

C:\Users\Admin\AppData\Local\Temp\ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b.exe
"C:\Users\Admin\AppData\Local\Temp\ce4ed339ef44aca4849346e1a7e453e2bde02c1d99652d1f17bbeecb8bc7793b.exe"
1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 848
    3⤵
    - Program crash
    PID:2576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4104 -ip 4104
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\apppatch\svchost.exe

Filesize
244KB

MD5
f3ae1d72caa48af3e75920eed4fd0e57

SHA1
38c7b1384ca67e409e139eea4f7f331bacb9136d

SHA256
721bba0363a19c49d8aaadc7e88f818ec70fe8aea2f55ab2a6024df7681102a2

SHA512
713e9db8ec34075a177a275a8ad3c112117967be8c3c549089b39758c199e9ecf075557278da33032e4a0afca9aa35ee8d7b6e7112ce04fcc74ff069e4c8baa7

Download Submit
memory/2072-0-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2072-1-0x00000000020A0000-0x0000000002108000-memory.dmp

Filesize
416KB

Download
memory/2072-2-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2072-14-0x00000000020A0000-0x0000000002108000-memory.dmp

Filesize
416KB

Download
memory/2072-15-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4104-12-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4104-16-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4104-17-0x00000000027A0000-0x00000000027EA000-memory.dmp

Filesize
296KB

Download
memory/4104-18-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/4104-19-0x0000000002B40000-0x0000000002B98000-memory.dmp

Filesize
352KB

Download
memory/4104-21-0x0000000002B40000-0x0000000002B98000-memory.dmp

Filesize
352KB

Download
memory/4104-23-0x0000000002B40000-0x0000000002B98000-memory.dmp

Filesize
352KB

Download
memory/4104-26-0x0000000002B40000-0x0000000002B98000-memory.dmp

Filesize
352KB

Download