d0d0c3f4c31b304677547ee7c470dde52f6d9811987899f26471dbdc0c43f283

General

Target

WgaTray.exe
Size

247KB
MD5

bfb7e29151fba0df4a899cda4a87353c
SHA1

36504c46318f32bbeb388933f27675169de1e752
SHA256

54b9311b8bcaad832f77f2033ac4abf2ff50a47ebbfe1561baed630962caa378
SHA512

e7b92f625f03f30125d4f21571f9995eaa83e33a8c55feb8e67fc33796ea554524b568ce1508efe8851999340f790e7bc8c21e4719d709a6c20239548ef594a8
SSDEEP

6144:pZlWJjHLs8V7fgSne4DqYpytHs//15gTYb4x5:gVHLX1neEq4ytE16x5

Score

6^/10

persistence

Malware Config

Signatures

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings\Data = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000024e5e9542d57048815fc8873c8aebdb040000000400000053000000106600000001000020000000e28a6c5dd99ba74b68c941566b73383981622e37eba2a2628401c6e8805500ff000000000e800000000200002000000016f7f5fd54a21a47abec219dde0f2d5fa44662efae6e185baf91bec160098a2a60010000a714715b7dd1173b9f02fc7c2144f36f519e71d2e505165822e5971a55cb00456f2f50cb85cd0f150c4ca622b4f13bed815cf18914f23de4f4bc55aeace7ab83e483f16070508c833061dca1b2ba33bd3bdd472d9847a9bb381c6cd31f0434178bba15fb260fa47cb33b0b338e7f77ebd6bfe8811d0417ee8701780573f7c0f5640c34be23b3ecb7ba2b080fc5bf8030b2f1e6bd84b8c686bba4e0a5f686a75d709cb83dccc8d6e62c18c58d48ef30ed38ea424b700734e0a72d06dbc092689786d6c35bdb582479850830dd49d93481bfbf6b6fb2439d88aebf1f00a72af5a25a20fbd514fd16739cb309044312ad23cdee67663e19437aa3d7450344015482d174db8ac26332a7fcbff9971650c11955705e1a1a532fae18b2489dfa2e5298ad5fa4fa21456a215e7289a31b462e9109fff42db0fe0c82d736e4387694b0b4b94562bfccb6562354be5ec7b53f423c0e03a659c98d4dbea4a29700f5ae1c9f40000000d2676563c408370c54dec07ebd70e841cba32e3fdea0d46d63eae513005e7d21b47a2187f56bd8bacc87ef4b0b18c20adaab621e03d325546389b256586f4c52	WgaTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Event = "0"	WgaTray.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings\Data = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000024e5e9542d57048815fc8873c8aebdb0400000004000000530000001066000000010000200000009bac023dd5065d55529187af3e7e996612f22b34fc23653aebb537de0cf995e0000000000e8000000002000020000000e2de1a3e14f3d53b9fe3861b9b6418171507d223b399cd0efab6160094b075d3b00100006fcddc224d59c6854256e26030ef0b7141fc031e5fba40aae3625927ab97c876a7ba98e02f8c52a2fed8d661ccf022a4b0fb590fd8227a53b04c6f3590d771d8eff985c86d0393b54f091bc708c9bd5af1269c0e831076f9ff62f77ef1b0b856308a1283a0ea43c43bec7fbf81730603dce1378b5fb4f90ec70a2e9e5832ae44a7c021a9cd301297497fbc3bb10e9e4bd873352d95421e07308e9aaceac1cd77de32a57c7c7b532a304c0bf09d3f3790de2ca02c99f9a7c59874d9dd274e60887bfe4b97b440bd3aa69f68d4c09639b09c54d1c9363799cf450879cb3f65e73316748b559456806fed156e7e621a0ce5a4b8040b7bfa98615bc8c76185303f2ab86c2526323e5fa2cba4c89005847ea124a94782a0c00beed180c3339089741952d9e39b2801b09260338e867c3325f06a3acf8a1a513bba2236b61b4e6deccf1082f9e74bacbcb3ba80d1b4db6498627cca67a2e0925f17f95e898bca0567257c6fb30aa24979c466b8d2d524f15a0fc9c3c1b00b68350379e5409999dae5738d9180686f30e8b3b7f915c4cb47ee3825d72d248f4f093f845d68d676182439796cbc67080b6508f3c1dcc2743442384000000008ca5f68d7896d4ff5c37a9bf6d1213b7af53e2670f536da12ebd398786d56eb360b46d8774cbbd37e634d1a945077d6dd0b5427250cb00186e44e967979b40a	WgaTray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings	WgaTray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	WgaTray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon	WgaTray.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings\Data = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000024e5e9542d57048815fc8873c8aebdb040000000400000053000000106600000001000020000000a7ac06f1b56e7c300f89aa924613732b0dd79e8e6599003dda6d6b7c02256da1000000000e8000000002000020000000850312f50952efd8ed8e3eb67a73d18ec436d25aa02cdeafc4dbfc36f7e8cd68f0000000ae763b8e36aab179fbd15679ac145fa886ebe51c9012a037cfc6bf92c1b677b1c8df66badf5fd6ebe12dd75a5efbb9ce0db3a0decdbe024916efabe3566c3b871e799df9b56ee535e27e889f78ee96ad9d401f68cab1195103b5d763a1803c74b2fc08db177d3fc83786b21db57e9291e345f858e1b693369ef6b7fed5fcb70da933ca4dd7aec1d96e357be79f94a906d1948a667012b82abc87d4bd42c2b9d1a751affd6d4d4c8f5e976d260f42c1921330471566ea65ce5c084cbb6a410f1a0f0844d93dc5d76569e6417b70a16511a637a7c6018689dce0028a3dc8301516f8e7984d55a830769d754cf201914b9b40000000d6e297455e4d28302b91c46d4ae12b25061525155a9d97db92d046a6a0a33789b61a22db761710a03b85a29f3e5956532269fbd9f4c47e2fdda385f519ae58c8	WgaTray.exe

C:\Users\Admin\AppData\Local\Temp\WgaTray.exe
"C:\Users\Admin\AppData\Local\Temp\WgaTray.exe"
1⤵
- Modifies WinLogon
PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2356-2-0x0000000000210000-0x0000000000214000-memory.dmp

Filesize
16KB

Download
memory/2356-4-0x00000000002C0000-0x00000000002C4000-memory.dmp

Filesize
16KB

Download
memory/2356-5-0x0000000000210000-0x0000000000214000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads