09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
11-06-2024 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe
Size

77KB
MD5

496b1fa8a1d45dc72e3fb7d529c1c290
SHA1

db9445a51b1f75806711948961c8f2d02acd1222
SHA256

09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b
SHA512

68e232665f8f905c23db7f3364037204a203c890a8450a5c2f31e5370520637ffd6573fa65df6d7a8ad7897a45a92151ea611ceca9265884775a374b55409b12
SSDEEP

1536:abSshapMJgKJUuxGmfJPtOgqm1s/XZSWcH8:K25KJFjfJPtOgqm2/XZX1

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

winlgon.exe

pid process

2156 winlgon.exe

pid	process
2156	winlgon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe

Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
4840	2156	WerFault.exe	winlgon.exe
2740	2760	WerFault.exe	09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exewinlgon.exe

pid process

2760 09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe
2156 winlgon.exe

pid	process
2760	09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe
2156	winlgon.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe

description	pid	process	target process
PID 2760 wrote to memory of 2156	2760	09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe	winlgon.exe
PID 2760 wrote to memory of 2156	2760	09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe	winlgon.exe
PID 2760 wrote to memory of 2156	2760	09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe	winlgon.exe

C:\Users\Admin\AppData\Local\Temp\09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe
"C:\Users\Admin\AppData\Local\Temp\09efcb928e45e096ce77661630ce65371bf1c7ceffefbb395b3f088ff08a399b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760

\??\c:\users\admin\appdata\local\temp\winlgon.exe
c:\users\admin\appdata\local\temp\winlgon.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 676
3⤵
- Program crash
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 600
2⤵
- Program crash
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2156 -ip 2156
1⤵
PID:4120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2760 -ip 2760
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\users\admin\appdata\local\temp\winlgon.exe

Filesize
77KB

MD5
4f013948f31b6066b4602aed2d3414f1

SHA1
c8b6e1fec7580fe563de3b44e9947920378c64c2

SHA256
82ffc51aee7a4ad612d8c2708e4bf775f8d8e7b396f2c4a00abd72d1ad33d735

SHA512
a091ef1375403feffe0b8f066ae9f590d526b9072c904f5e8b32e370deb59c0f3ae801de2285b8a4b23b3d058efee1c9fb5fcaeda74b37a3ea876a79e7399f3d

Download Submit