Analysis
-
max time kernel
120s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
22/07/2024, 20:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a76f9c9e44d3d5a3f1e283dc334a320N.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
120 seconds
Behavioral task
behavioral2
Sample
0a76f9c9e44d3d5a3f1e283dc334a320N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
120 seconds
General
-
Target
0a76f9c9e44d3d5a3f1e283dc334a320N.exe
-
Size
725KB
-
MD5
0a76f9c9e44d3d5a3f1e283dc334a320
-
SHA1
ae6dc0562f66434a6db8fd936b51c36531c7378e
-
SHA256
d9460bef7ee53ef08cdfd8a45e01b7913a07fee7c2ae9d87d46d2fb4b914f02f
-
SHA512
b84da827ae0d75665406d7e4a625d567fb1813b891b6225737787b03c02885d0886d11724ee2d032170a34b92deba94ba62401ad9836fed728326041f2499dd5
-
SSDEEP
12288:lM+wSnCwWLMkskJtA8Ilr3xRZjkSCwWLMVLXwKKoqbsrw2/wX:lN05LRskvIlB1C5LqwKKoozX
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe," 0a76f9c9e44d3d5a3f1e283dc334a320N.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\pathx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0a76f9c9e44d3d5a3f1e283dc334a320N.exe" 0a76f9c9e44d3d5a3f1e283dc334a320N.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntos.exe 0a76f9c9e44d3d5a3f1e283dc334a320N.exe File created C:\Windows\SysWOW64\ntos.exe 0a76f9c9e44d3d5a3f1e283dc334a320N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5 PID 232 wrote to memory of 612 232 0a76f9c9e44d3d5a3f1e283dc334a320N.exe 5
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\0a76f9c9e44d3d5a3f1e283dc334a320N.exe"C:\Users\Admin\AppData\Local\Temp\0a76f9c9e44d3d5a3f1e283dc334a320N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:232