5767793f0dfb6f5d82b54adde313de3d84cdf4b9a4d3e7c6595095a5147e6268

Analysis

max time kernel
125s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
05-07-2024 21:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5767793f0dfb6f5d82b54adde313de3d84cdf4b9a4d3e7c6595095a5147e6268.exe
Size

78KB
MD5

f164bfb9c0f82557d0089e286a080a37
SHA1

0796c880db7aba5292ad9d9b5ef84a22ed95d37e
SHA256

5767793f0dfb6f5d82b54adde313de3d84cdf4b9a4d3e7c6595095a5147e6268
SHA512

360ce91c8f06eeed73cf429b5a65c3ca95ddaafa07da2b9eca36c7b46674d469974be24428700a92b5efa1dbc2c35570daa1582a92c9824e64b654511f589478
SSDEEP

1536:abSshapMJgKJUuxGmfJPtOgqm1s/XZSWcHoov:K25KJFjfJPtOgqm2/XZXcv

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4336	winlgon.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	5767793f0dfb6f5d82b54adde313de3d84cdf4b9a4d3e7c6595095a5147e6268.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-661257284-3186977026-4220467887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlgon.exe = "c:\\users\\admin\\appdata\\local\\temp\\winlgon.exe"	5767793f0dfb6f5d82b54adde313de3d84cdf4b9a4d3e7c6595095a5147e6268.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1812	4336	WerFault.exe	90
4612	3496	WerFault.exe	88

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3496	5767793f0dfb6f5d82b54adde313de3d84cdf4b9a4d3e7c6595095a5147e6268.exe
4336	winlgon.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 4336	3496	5767793f0dfb6f5d82b54adde313de3d84cdf4b9a4d3e7c6595095a5147e6268.exe	90
PID 3496 wrote to memory of 4336	3496	5767793f0dfb6f5d82b54adde313de3d84cdf4b9a4d3e7c6595095a5147e6268.exe	90
PID 3496 wrote to memory of 4336	3496	5767793f0dfb6f5d82b54adde313de3d84cdf4b9a4d3e7c6595095a5147e6268.exe	90

C:\Users\Admin\AppData\Local\Temp\5767793f0dfb6f5d82b54adde313de3d84cdf4b9a4d3e7c6595095a5147e6268.exe
"C:\Users\Admin\AppData\Local\Temp\5767793f0dfb6f5d82b54adde313de3d84cdf4b9a4d3e7c6595095a5147e6268.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3496
- \??\c:\users\admin\appdata\local\temp\winlgon.exe
  c:\users\admin\appdata\local\temp\winlgon.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 696
    3⤵
    - Program crash
    PID:1812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 572
  2⤵
  - Program crash
  PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4336 -ip 4336
1⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3496 -ip 3496
1⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4180,i,13036770025638384416,811858527135662588,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\winlgon.exe

Filesize
78KB

MD5
c2edf16b7fc2ccc4d29ec68b8e76bc5c

SHA1
cf64faf4c4f97dcd49ae3a34d155cceda98906c7

SHA256
fdd0b6daaaf0d6b0dad4e86213fec25361d6f2a608757638ef5d6eda17684855

SHA512
c1ef4970239eda455e43016908f9a8ad42f939d7ea84638c43a39a89feacc8993e28d7eee57d6c1efdbcbd212a0698b80faa9317a3fc6fe6729ab9a1a0b20b86

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads