9f216a073f8083a2525597ade8f3da6f3a629e567f8f88483d1990d22b237b99

Analysis

max time kernel
103s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 02:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37803ea7055ac72b1d89f95a61407b00N.exe
Size

63KB
MD5

37803ea7055ac72b1d89f95a61407b00
SHA1

be4c61a1394437bc523815b3ef9186d9b72f4f1d
SHA256

9f216a073f8083a2525597ade8f3da6f3a629e567f8f88483d1990d22b237b99
SHA512

bf927392d9517ca14bc3c5165201853f0df5c4d65abbd1c55bc22e8e15a0414ffdfbd1c01cff47d92b274f38d4c395a61a8b39ef4984c35b787b44c30158a203
SSDEEP

384:5EueqcNOpLsz3YN6RTqjTPJOGjMuPr8JMD+jQLv5OzeXy:SueqsOpLszoFvwUQJCy25eeXy

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Deletes itself 1 IoCs

pid	Process
2340	ice20060825.bak

Executes dropped EXE 1 IoCs

pid	Process
2340	ice20060825.bak

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinIce\Shutdown = "Gs2Shutdown"	ice20060825.bak
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinIce\Startup = "Gs2Startup"	ice20060825.bak
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinIce\Asynchronous = "1"	ice20060825.bak
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinIce\Impersonate = "0"	ice20060825.bak
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinIce	ice20060825.bak
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	ice20060825.bak
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinIce\DllName = "C:\\Windows\\system32\\winice.dll"	ice20060825.bak

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37803ea7055ac72b1d89f95a61407b00N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ice20060825.bak

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2340	ice20060825.bak
2340	ice20060825.bak

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2340	ice20060825.bak

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2340	1520	37803ea7055ac72b1d89f95a61407b00N.exe	85
PID 1520 wrote to memory of 2340	1520	37803ea7055ac72b1d89f95a61407b00N.exe	85
PID 1520 wrote to memory of 2340	1520	37803ea7055ac72b1d89f95a61407b00N.exe	85
PID 2340 wrote to memory of 616	2340	ice20060825.bak	5

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616

C:\Users\Admin\AppData\Local\Temp\37803ea7055ac72b1d89f95a61407b00N.exe
"C:\Users\Admin\AppData\Local\Temp\37803ea7055ac72b1d89f95a61407b00N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Users\Admin\AppData\Local\Temp\ice20060825.bak
  "C:\Users\Admin\AppData\Local\Temp\ice20060825.bak" *C:\Users\Admin\AppData\Local\Temp\37803ea7055ac72b1d89f95a61407b00N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies WinLogon
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ice20060825.bak

Filesize
63KB

MD5
37803ea7055ac72b1d89f95a61407b00

SHA1
be4c61a1394437bc523815b3ef9186d9b72f4f1d

SHA256
9f216a073f8083a2525597ade8f3da6f3a629e567f8f88483d1990d22b237b99

SHA512
bf927392d9517ca14bc3c5165201853f0df5c4d65abbd1c55bc22e8e15a0414ffdfbd1c01cff47d92b274f38d4c395a61a8b39ef4984c35b787b44c30158a203

Download Submit
memory/1520-2-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2340-5-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download