d0d0c3f4c31b304677547ee7c470dde52f6d9811987899f26471dbdc0c43f283

General

Target

WgaTray.exe
Size

247KB
MD5

bfb7e29151fba0df4a899cda4a87353c
SHA1

36504c46318f32bbeb388933f27675169de1e752
SHA256

54b9311b8bcaad832f77f2033ac4abf2ff50a47ebbfe1561baed630962caa378
SHA512

e7b92f625f03f30125d4f21571f9995eaa83e33a8c55feb8e67fc33796ea554524b568ce1508efe8851999340f790e7bc8c21e4719d709a6c20239548ef594a8
SSDEEP

6144:pZlWJjHLs8V7fgSne4DqYpytHs//15gTYb4x5:gVHLX1neEq4ytE16x5

Score

6^/10

persistence

Malware Config

Signatures

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings\Data = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005861a9550fc8d84aa2c5f22e5aec105d0400000004000000530000001066000000010000200000007a9933d4ad6e97fc3f020b7164f8574984a8bbef87ca3ffb0c2dff170e5f8437000000000e800000000200002000000087f4df222d0f2bcac211666bbb7f93149b4d8f69379e6e8881b4023a06fd930b60010000e3ec97eac01cc3b28bfe2d3ab8bfefc04155b0ce616fc19c6e3bafb12f74ce0364ac5eedd686d52503c2808707a105b80026971d2238e39e8fc0db70ce732379167914b9c7e8b32d36454a6447e5c7d2898b7a182b4f885e402a5043622cf859f2225f2a9a6f78c51ffda88c0e068717abcda05937119c995ab7096b4e6bae564a04fbeef23b4f4791efa01bbc01dadc1c61725f046df12ad52777fdf73ef66d77749f324ef6ef0e5fd5ad14a29fae3c266dad175cf7635f72ee52b17d475f2de77d20c43c8004c86384979cb89f25539036327671e135be0beb8fc45d9750aa276c376989d37f831b21b90241e0eab73ec44cb4542f4979ad4aee5f90cc0d7019623642837bf7a54d71a0e495cf0dbc7635ac968f0de5dfbe827f732798cab5fb155a516a2b4f2d0b868bc2803089640a81e8d67104db99bfda47c191224bd7d328c282d38d22a4e9c02a43f11640e18d151ee4331b003da72dd924f54158404000000048ddda2f244c2218b1bfb1aa605425e4e941b671379e6829722433c440f35a202a63898b672d763f97bb24ea9ed300d3f0e1aaaf9d921aae8dfdc1d309ad19c9	WgaTray.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Event = "0"	WgaTray.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings\Data = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005861a9550fc8d84aa2c5f22e5aec105d0400000004000000530000001066000000010000200000009c7ffbfa79f943f4ec7512be13b653257e2bf3362008bed1d7746610029e5db6000000000e8000000002000020000000b970009af9b5e5a60ebf941693d13af05802c3336d15218ee8d8dcd3f83e6a33b0010000ee064c6fa156a4a9c9fc6ccb71a34b54f0f819a4b116be899c7f104648f8bcb0daff82f316c111b8dd1590d216199eb49d82d5742f34584de092066a1b4bdfa36a7d36ae5b388aad67e0dcdbd46cd1e26406b6c57c81f4c9a54e78c7e2d3eb59e65764284973d196800b13844582f85e0f0887eb4727c4bce61ce17e1f7b3512a9498acfd7650f659902003aca681dc1dbf23dfb89def28e3ad02506966a40b04cd327b361d548f1978ffeacc06d4f62dbe1972093a370b2aaeb787838fdf37c74bdab55280e4e7f0bc1f8d904bc9e08c546ce5c87a16a9d71b0b843db40d503c6f2f4ae3b79cf6138b03d4893d10a9a0f55a8b4bfd9a600273c57d6a2c9a25ff8af5be9f5a4da5550de65e65eeaa3f9c334ee2375f9f5142d71e46b3f566f029c9cda6ad6025fa9beac1a43b060f8783b6330c4654ffd00ac22d21f87a00f0d2e1fd6c3bc3faf430e0f3c936a64c8505fc566def662fcb2442df84706d68a917f63fe419660ce18655dcddb7b133370c835dbbe726b7dbc0bd644a619623af13f099821868fb5c39ee63c22cc48fba8bf20721ea17decc3a9cf26fdf91c7a5da850219bff42b3cee6402e07fffa22d84000000079699ffd4d20e0c71219577c0215499cd1838bda08eed24a3ef4fed6982ebf67a62a35216001eb12a5504c6e6553f05931005f9802b5bc14e561dec0a9dddb46	WgaTray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings	WgaTray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	WgaTray.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon	WgaTray.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings\Data = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005861a9550fc8d84aa2c5f22e5aec105d0400000004000000530000001066000000010000200000005fe23a8724a2e81304f53ef400f32f8746e6a63421809eb924a5ba85ad664c51000000000e800000000200002000000082e9da079994b31329663b27902a1c35feb1204872304bc1cfe597c156cfb9e1f000000079f7bb6ef2ddd18c1be049d2401fe764077007140604050ae00d5167e3945534ec56c22b345895d1b6a92816c97bbd72002fb80105ba10cb23dd3bff641143d99594f4e140bcd960e3a716778a8000c91b3e937f17131efae022ea24689f92a8c95253e7ce4a6fb69c03cbdce9e676d0d2b5163c1868d8c75c87b0a9f06d5a46d745fd5fe22ee564f16d797a1110f0cfc30fe0d8aa2cb03b38fecd1ff3f40edf2f7daa672d2537172fb262adf54e53037053f4f5641fd71a9496457422199eed3fcdc7a2b9cf2fccbd580297d808eae4f05ee1dd22d1d511b3625b9c0bcc5f0f1679e2fcfef20d6c3baa2aa89ee3fa8940000000ef3c37a9e2ab9cc0942ff81f97a95ca668a2f2628c1622dffbf0790c1e5524405593823a43f62a89eb94f2a81811bdeda66bb8e7335b4a9589106b6e103d163b	WgaTray.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3088	WgaTray.exe
Token: SeIncBasePriorityPrivilege	3088	WgaTray.exe

C:\Users\Admin\AppData\Local\Temp\WgaTray.exe
"C:\Users\Admin\AppData\Local\Temp\WgaTray.exe"
1⤵
- Modifies WinLogon
- Suspicious use of AdjustPrivilegeToken
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3088-2-0x0000000000A90000-0x0000000000A94000-memory.dmp

Filesize
16KB

Download
memory/3088-4-0x0000000000AA0000-0x0000000000AA4000-memory.dmp

Filesize
16KB

Download
memory/3088-5-0x0000000000A90000-0x0000000000A94000-memory.dmp

Filesize
16KB

Download
memory/3088-6-0x0000000000A90000-0x0000000000A94000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads