c69bad2e167f4807d04d296fdea7ac4749afee4dbb6d5ccf358c30af74483e8a

Analysis

max time kernel
64s
max time network
59s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 04:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c69bad2e167f4807d04d296fdea7ac4749afee4dbb6d5ccf358c30af74483e8a.exe
Size 77KB
Sample240612-enfrfazhpp
SHA256 c69bad2e167f4807d04d296fdea7ac4749afee4dbb6d5ccf358c30af74483e8a
MD5 04f4e81b4ca3a58a30ad46a520e1320e
SHA1 f8564377e6e3df343be529e99c9196d293a6e403
SHA512 b5418427762d5d70b8506d3fcd15c3b721c29a8811f296c001d0b33d7e41f3ada1626fb4fc1313f3ea8435fd53c9ca21a1f8be8ebd7fd482d13e6d4fa4ce89b8
SSDEEP 1536:etFOJJdCu4bqshaxlyWd6NWhnPwYshiiyaECHAX5mROMwOMQ28P:EFWJ8u4Qly9E9PwYssie0ROfOIu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2476	winlgon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	c69bad2e167f4807d04d296fdea7ac4749afee4dbb6d5ccf358c30af74483e8a.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	c69bad2e167f4807d04d296fdea7ac4749afee4dbb6d5ccf358c30af74483e8a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4996	c69bad2e167f4807d04d296fdea7ac4749afee4dbb6d5ccf358c30af74483e8a.exe
2476	winlgon.exe
2476	winlgon.exe
2476	winlgon.exe
2476	winlgon.exe
2476	winlgon.exe
2476	winlgon.exe
2476	winlgon.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2476	4996	c69bad2e167f4807d04d296fdea7ac4749afee4dbb6d5ccf358c30af74483e8a.exe	81
PID 4996 wrote to memory of 2476	4996	c69bad2e167f4807d04d296fdea7ac4749afee4dbb6d5ccf358c30af74483e8a.exe	81
PID 4996 wrote to memory of 2476	4996	c69bad2e167f4807d04d296fdea7ac4749afee4dbb6d5ccf358c30af74483e8a.exe	81

C:\Users\Admin\AppData\Local\Temp\c69bad2e167f4807d04d296fdea7ac4749afee4dbb6d5ccf358c30af74483e8a.exe
"C:\Users\Admin\AppData\Local\Temp\c69bad2e167f4807d04d296fdea7ac4749afee4dbb6d5ccf358c30af74483e8a.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996
- \??\c:\users\admin\appdata\local\temp\winlgon.exe
  c:\users\admin\appdata\local\temp\winlgon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX3C7C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX3C7C.tmp
Size 76KB
SHA256 f45c1cf8a46832a131bc8d79012cb5d3e7e742e16ea5389fb08f5a72fbd4ed06
MD5 cf1ae803f7cfffd25556757681da5c39
SHA1 5419e16a039223b921bb8d93735daab8782537cc
SHA512 0b71c2370032ac5ceda5eebbb7af4f2ef1b15e26872fe2c877af277de47e61b8c47e1239ce5ba45bd9655f2c8d376dfce30b09da53a01074626fb990d85a7102
SSDEEP 1536:etFOJJdCu4bqshaxlyWd6NWhnPwYshiiyaECHAX5mROMwOMQ2o:EFWJ8u4Qly9E9PwYssie0ROfOIo
MD5 SHA1 SHA512 SSDEEP

Submit Download

winlgon.exe

Path C:\Users\Admin\AppData\Local\Temp\winlgon.exe
Size 77KB
SHA256 292d96d2036025bfcc4083b973a9639f1e54d4ed1fbfc00b8044fa1c48066abf
MD5 aa302522740056ab7c1d6d19e5fe3ed2
SHA1 c9675464a2ae1af6b3da8e1ead8e4733c1e5f842
SHA512 00c8e6d71ff52b116b18209fd6e6e92dd8665eeedccbc622413c4e5060f476db3542d060b6fbb1cca085dac32e5614f8509a74aee43b23683c2fd7b054ab2449
SSDEEP 1536:etFOJJdCu4bqshaxlyWd6NWhnPwYshiiyaECHAX5mROMwOMQ28p:EFWJ8u4Qly9E9PwYssie0ROfOIY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads