Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 04:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8629c3697c962d8320e58d2ad0cbf3f0N.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral2
Sample
8629c3697c962d8320e58d2ad0cbf3f0N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
120 seconds
General
-
Target
8629c3697c962d8320e58d2ad0cbf3f0N.exe
-
Size
205KB
-
MD5
8629c3697c962d8320e58d2ad0cbf3f0
-
SHA1
7f753c79a585403c3cc171db55eea94103e62902
-
SHA256
e5ca6d75059db7527ab4d77add007f15e60e0090373c7746ce9c878752fa3126
-
SHA512
ca2a88c2350a89d5ed0b82702b5ed08087dd6594fa67b05c674eb3b3508e18431fa5f6b79b1c6e99f5fb51b468daa42d2f4fbb10ffdc75626e07c2a12f265cc3
-
SSDEEP
3072:lBk8mIvuEPGb02TaQgAWCHYdKU3pneWDB5YsUpUr88GjVMQcixs2dLcqJJyTP:lBPQ7Dy/eWBixpn8cqQ/xN7JyTP
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe," 8629c3697c962d8320e58d2ad0cbf3f0N.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\pathx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8629c3697c962d8320e58d2ad0cbf3f0N.exe" 8629c3697c962d8320e58d2ad0cbf3f0N.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntos.exe 8629c3697c962d8320e58d2ad0cbf3f0N.exe File created C:\Windows\SysWOW64\ntos.exe 8629c3697c962d8320e58d2ad0cbf3f0N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5 PID 3244 wrote to memory of 624 3244 8629c3697c962d8320e58d2ad0cbf3f0N.exe 5
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\8629c3697c962d8320e58d2ad0cbf3f0N.exe"C:\Users\Admin\AppData\Local\Temp\8629c3697c962d8320e58d2ad0cbf3f0N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244