Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 19:07
Static task
static1
Behavioral task
behavioral1
Sample
143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe
Resource
win10v2004-20240508-en
General
-
Target
143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe
-
Size
201KB
-
MD5
324f7af12eb64184a320717bf6ab5061
-
SHA1
bc2c8a7e90964a5263cab3014b20c293593a2abc
-
SHA256
143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7
-
SHA512
74db54eaea243ab3764ad823369d4055f25d1d5aa501bab99c6617ec2d7113ff7ed9b87a62cc95ddf5b385f8f85287f8fa4501008f8bcf97bc9867cba3431dcd
-
SSDEEP
6144:7t++Jbojf5Vq5OC4qZhZcKYhc/ZfUozY:w+cff22qZhZcKYhc/
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 224 svchost.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\ce443e\desktop.ini svchost.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\df4191 = "C:\\Windows\\apppatch\\svchost.exe" 143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\df4191 = "C:\\Windows\\apppatch\\svchost.exe" svchost.exe -
Drops file in Program Files directory 52 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Defender\symbols\DLL\wkernel32.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\wntdll.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\dll\wrpcrt4.pdb svchost.exe File created C:\Program Files (x86)\Windows Defender\pupydeq.com svchost.exe File created C:\Program Files (x86)\Windows Defender\galyqaz.com svchost.exe File created C:\Program Files (x86)\Windows Defender\galynuh.com svchost.exe File created C:\Program Files (x86)\Windows Defender\vocyzit.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\gahyhiz.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\WinSCard.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\vofycot.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\pupycag.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\vonypom.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\gadyciz.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\winsta.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\pupydeq.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\wrpcrt4.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\symbols\dll\winsta.pdb svchost.exe File created C:\Program Files (x86)\Windows Defender\lygyvuj.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\galyqaz.com svchost.exe File created C:\Program Files (x86)\Windows Defender\pupycag.com svchost.exe File created C:\Program Files (x86)\Windows Defender\vofycot.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\wkernelbase.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\lymyxid.com svchost.exe File created C:\Program Files (x86)\Windows Defender\gatyfus.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\lyxynyx.com svchost.exe File created C:\Program Files (x86)\Windows Defender\qegyval.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\qegyval.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\lygyvuj.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\symbols\dll\WinSCard.pdb svchost.exe File created C:\Program Files (x86)\Windows Defender\vonypom.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\dll\wntdll.pdb svchost.exe File created C:\Program Files (x86)\Windows Defender\lyxynyx.com svchost.exe File created C:\Program Files (x86)\Windows Defender\qetyhyg.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\symbols\dll\wrpcrt4.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\wkernel32.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\qexyhuv.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\qetyhyg.com svchost.exe File created C:\Program Files (x86)\Windows Defender\gahyhiz.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\galynuh.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\qetyfuv.com svchost.exe File created C:\Program Files (x86)\Windows Defender\gadyciz.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\symbols\dll\wkernelbase.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\symbols\dll\wntdll.pdb svchost.exe File created C:\Program Files (x86)\Windows Defender\qetyfuv.com svchost.exe File created C:\Program Files (x86)\Windows Defender\qexyhuv.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\dll\WinSCard.pdb svchost.exe File created C:\Program Files (x86)\Windows Defender\lymyxid.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\DLL\wkernel32.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\dll\winsta.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\gatyfus.com svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\dll\wkernelbase.pdb svchost.exe File opened for modification C:\Program Files (x86)\Windows Defender\vocyzit.com svchost.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\svchost.exe 143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe File opened for modification C:\Windows\apppatch\svchost.exe 143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 224 svchost.exe 224 svchost.exe 224 svchost.exe 224 svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2192 143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2192 wrote to memory of 224 2192 143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe 84 PID 2192 wrote to memory of 224 2192 143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe 84 PID 2192 wrote to memory of 224 2192 143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe"C:\Users\Admin\AppData\Local\Temp\143e9451e14b212450a8787576580007e6423b2fe211df7801e17aafb53e73f7.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops desktop.ini file(s)
- Modifies WinLogon
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:224
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD51f1a596909c1b05d438b40a7ea42e26a
SHA1c7669fc38d1fb389e9881a42c1a60e8af9194946
SHA256f0e97ebb6d8715b3a7889bd766f961c171554132188fa6c7ca80509abcbfd9bf
SHA512016cd6e8cbfdf3a4d64b02e8268530798e42377a14d977c503ba0a1bf0dea7b9d217e55548056b1197248ccb1997fdd7f20216e8643b9a432569a677279f4e26
-
Filesize
457B
MD5531ec87a0b2f9477a52d88b111d0d46a
SHA150a72e5752075309f91c062e0282a7e7cd1e751e
SHA2564875b451859b1eb8d0d3b040b1bb8d654d212edb6d9c721cf0f4372129579385
SHA51207994963fd76b31ef0ba2c7f418dcb3ee0290f6baca2d8ec63a6e6b861557b13fbc20d2f0a10a66f35c4d72d4d2c1920ac88b96174604f2f8856868912327da1
-
Filesize
593B
MD5926512864979bc27cf187f1de3f57aff
SHA1acdeb9d6187932613c7fa08eaf28f0cd8116f4b5
SHA256b3e893a653ec06c05ee90f2f6e98cc052a92f6616d7cca8c416420e178dcc73f
SHA512f6f9fd3ca9305bec879cfcd38e64111a18e65e30d25c49e9f2cd546cbab9b2dcd03eca81952f6b77c0eaab20192ef7bef0d8d434f6f371811929e75f8620633b
-
Filesize
114B
MD5bfde1e9e9c32c1681a16139450c6909d
SHA17e669b927e6a75a10a0ca29e38e58ddcb49b725e
SHA256e0d020ba1cb6506cee234903a44c747ee0cfa7e2d1e60029e4cd8de9a431512a
SHA512781fd54f155442dd34f9919b3cd063ee399db411bbfe15f2bdc43d3ab8ac2d04e1011b2c99fab42bebf7b903a94e09aaaef71b7a465d2d04b417f6dad8e8e396
-
Filesize
114B
MD5e89f75f918dbdcee28604d4e09dd71d7
SHA1f9d9055e9878723a12063b47d4a1a5f58c3eb1e9
SHA2566dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023
SHA5128df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0
-
Filesize
168B
MD5d57e3a550060f85d44a175139ea23021
SHA12c5cb3428a322c9709a34d04dd86fe7628f8f0a6
SHA25643edf068d34276e8ade4113d4d7207de19fc98a2ae1c07298e593edae2a8774c
SHA5120364fe6a010fce7a3f4a6344c84468c64b20fd131f3160fc649db78f1075ba52d8a1c4496e50dbe27c357e01ee52e94cdcda8f7927cba28d5f2f45b9da690063
-
Filesize
201KB
MD5a0ee6dea708e65327ad51a8c8c01f1b1
SHA14042002c3de351145569cb727b4ceab944873a89
SHA2562b4a9203e584b837e6f178e8bb6c318495d8d80f6270ab3679f7dab4852251db
SHA51297664ccd9cc80b0f50089ba5cb8f695fa621b4696ebe18d06161eb036b7987459485a79d80c1117b77c36610da9dcf84e103ff599dfc95073bcb45341e57615a