Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 19:07

General

  • Target

    143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe

  • Size

    201KB

  • MD5

    324f7af12eb64184a320717bf6ab5061

  • SHA1

    bc2c8a7e90964a5263cab3014b20c293593a2abc

  • SHA256

    143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7

  • SHA512

    74db54eaea243ab3764ad823369d4055f25d1d5aa501bab99c6617ec2d7113ff7ed9b87a62cc95ddf5b385f8f85287f8fa4501008f8bcf97bc9867cba3431dcd

  • SSDEEP

    6144:7t++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:w+cff22qZhZcKYhc/

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Modifies WinLogon 2 TTPs 2 IoCs
  • Drops file in Program Files directory 52 IoCs
  • Drops file in Windows directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe
    "C:\Users\Admin\AppData\Local\Temp\143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:2192
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Executes dropped EXE
      • Drops desktop.ini file(s)
      • Modifies WinLogon
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      PID:224

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Windows Defender\galyqaz.com

          Filesize

          42KB

          MD5

          1f1a596909c1b05d438b40a7ea42e26a

          SHA1

          c7669fc38d1fb389e9881a42c1a60e8af9194946

          SHA256

          f0e97ebb6d8715b3a7889bd766f961c171554132188fa6c7ca80509abcbfd9bf

          SHA512

          016cd6e8cbfdf3a4d64b02e8268530798e42377a14d977c503ba0a1bf0dea7b9d217e55548056b1197248ccb1997fdd7f20216e8643b9a432569a677279f4e26

        • C:\Program Files (x86)\Windows Defender\qegyval.com

          Filesize

          457B

          MD5

          531ec87a0b2f9477a52d88b111d0d46a

          SHA1

          50a72e5752075309f91c062e0282a7e7cd1e751e

          SHA256

          4875b451859b1eb8d0d3b040b1bb8d654d212edb6d9c721cf0f4372129579385

          SHA512

          07994963fd76b31ef0ba2c7f418dcb3ee0290f6baca2d8ec63a6e6b861557b13fbc20d2f0a10a66f35c4d72d4d2c1920ac88b96174604f2f8856868912327da1

        • C:\Program Files (x86)\Windows Defender\qetyhyg.com

          Filesize

          593B

          MD5

          926512864979bc27cf187f1de3f57aff

          SHA1

          acdeb9d6187932613c7fa08eaf28f0cd8116f4b5

          SHA256

          b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f

          SHA512

          f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b

        • C:\Program Files (x86)\Windows Defender\qexyhuv.com

          Filesize

          114B

          MD5

          bfde1e9e9c32c1681a16139450c6909d

          SHA1

          7e669b927e6a75a10a0ca29e38e58ddcb49b725e

          SHA256

          e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a

          SHA512

          781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\J2J1W33T\login[3].htm

          Filesize

          114B

          MD5

          e89f75f918dbdcee28604d4e09dd71d7

          SHA1

          f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

          SHA256

          6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

          SHA512

          8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VLW1SL5J\login[3].htm

          Filesize

          168B

          MD5

          d57e3a550060f85d44a175139ea23021

          SHA1

          2c5cb3428a322c9709a34d04dd86fe7628f8f0a6

          SHA256

          43edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c

          SHA512

          0364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063

        • C:\Windows\apppatch\svchost.exe

          Filesize

          201KB

          MD5

          a0ee6dea708e65327ad51a8c8c01f1b1

          SHA1

          4042002c3de351145569cb727b4ceab944873a89

          SHA256

          2b4a9203e584b837e6f178e8bb6c318495d8d80f6270ab3679f7dab4852251db

          SHA512

          97664ccd9cc80b0f50089ba5cb8f695fa621b4696ebe18d06161eb036b7987459485a79d80c1117b77c36610da9dcf84e103ff599dfc95073bcb45341e57615a

        • memory/224-52-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-49-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-19-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/224-20-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-24-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-22-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-25-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-37-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-79-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-78-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-77-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-76-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-75-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-74-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-73-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-72-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-71-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-69-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-68-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-67-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-66-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-64-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-63-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-60-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-58-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-59-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-57-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-56-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-55-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-54-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-53-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-14-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/224-51-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-46-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-16-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/224-47-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-48-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-45-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-44-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-43-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-42-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-41-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-40-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-39-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-38-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-36-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-34-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-33-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-32-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-31-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-30-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-29-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-28-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-27-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-70-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-65-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-62-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-61-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-50-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-35-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-26-0x0000000002BF0000-0x0000000002CA2000-memory.dmp

          Filesize

          712KB

        • memory/224-17-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/224-18-0x0000000002A40000-0x0000000002AE4000-memory.dmp

          Filesize

          656KB

        • memory/2192-0-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB

        • memory/2192-1-0x00000000021F0000-0x000000000223F000-memory.dmp

          Filesize

          316KB

        • memory/2192-15-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2192-2-0x0000000000400000-0x000000000045C000-memory.dmp

          Filesize

          368KB

        • memory/2192-13-0x00000000021F0000-0x000000000223F000-memory.dmp

          Filesize

          316KB

        • memory/2192-12-0x0000000000400000-0x0000000000491000-memory.dmp

          Filesize

          580KB