Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
07/06/2024, 21:10
General
-
Target
wininit.exe
-
Size
53KB
-
MD5
1afa5d79303cd6a555bc8104dc2b8f8a
-
SHA1
9219b262abbd01ff144badd7b7e403a48d4e3763
-
SHA256
eda92439a40101e33a542ac1545c722ba43f77407bf117181c7f207fd9ec55bf
-
SHA512
5c8fbe2b5dd7b00d9570bead3dfe90e7b257562b2173fac7065d5a6168d55c4dd947c083a89d8ad0dc7d1373292499ef12fc88d0060c5db3e392aec8a50b5531
-
SSDEEP
1536:Lbne4IqDlL4VnnauImeVsrhQQJ3oMPDS3b19Q:L64IQlL4VxRhdJVrS3b4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\wininit.exe"C:\Users\Admin\AppData\Local\Temp\wininit.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "wininit" /tr "C:\ProgramData\wininit.exe"2⤵
- Creates scheduled task(s)
-
-
C:\ProgramData\wininit.exeC:\ProgramData\wininit.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\wininit.exeC:\ProgramData\wininit.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\wininit.exeC:\ProgramData\wininit.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD51afa5d79303cd6a555bc8104dc2b8f8a
SHA19219b262abbd01ff144badd7b7e403a48d4e3763
SHA256eda92439a40101e33a542ac1545c722ba43f77407bf117181c7f207fd9ec55bf
SHA5125c8fbe2b5dd7b00d9570bead3dfe90e7b257562b2173fac7065d5a6168d55c4dd947c083a89d8ad0dc7d1373292499ef12fc88d0060c5db3e392aec8a50b5531
-
Filesize
660B
MD51c5e1d0ff3381486370760b0f2eb656b
SHA1f9df6be8804ef611063f1ff277e323b1215372de
SHA256f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
SHA51278f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
-
Filesize
8KB
-
Filesize
80KB
-
Filesize
72KB
-
Filesize
10.8MB
-
Filesize
8KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB