Analysis
-
max time kernel
120s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
26-07-2024 10:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c689de910f60fca011e55c1b0ffd6d40N.exe
Resource
win7-20240705-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
c689de910f60fca011e55c1b0ffd6d40N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
120 seconds
General
-
Target
c689de910f60fca011e55c1b0ffd6d40N.exe
-
Size
1.1MB
-
MD5
c689de910f60fca011e55c1b0ffd6d40
-
SHA1
c4d0a91462039c68f560bef797696fe1698858a9
-
SHA256
5327b58852ae0063d9dba4d41f6cb142e3244f775ac5866a99261b034cea1329
-
SHA512
e4cd73d47caab6216fbc2b1d0ebd7e9889de07bae295dcc1423962552bd1fa752006935cf3ee7588c8736ede75ad607b81ec20444a2f6fc7a209300833fa5637
-
SSDEEP
24576:lN05LRsk+598a3Va0Jca+Qc5UKGCfwopONUcBlYD:l6aa4cPSBpLYD
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\ntos.exe," c689de910f60fca011e55c1b0ffd6d40N.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\pathx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c689de910f60fca011e55c1b0ffd6d40N.exe" c689de910f60fca011e55c1b0ffd6d40N.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ntos.exe c689de910f60fca011e55c1b0ffd6d40N.exe File created C:\Windows\SysWOW64\ntos.exe c689de910f60fca011e55c1b0ffd6d40N.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c689de910f60fca011e55c1b0ffd6d40N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 3088 c689de910f60fca011e55c1b0ffd6d40N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3088 c689de910f60fca011e55c1b0ffd6d40N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5 PID 3088 wrote to memory of 616 3088 c689de910f60fca011e55c1b0ffd6d40N.exe 5
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\c689de910f60fca011e55c1b0ffd6d40N.exe"C:\Users\Admin\AppData\Local\Temp\c689de910f60fca011e55c1b0ffd6d40N.exe"1⤵
- Modifies WinLogon for persistence
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088