Analysis
-
max time kernel
119s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe
Resource
win10v2004-20241007-en
General
-
Target
60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe
-
Size
1.5MB
-
MD5
b8b46b60f639dead446a53248de82e80
-
SHA1
cc79968f543e3e094b97f9dd2137fc29d642306e
-
SHA256
60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4
-
SHA512
3e360a51dd7edb8305e72705e41670dd6a0ba6dedf3a292eeb6709362a6493cf18e749456b627153da061ca602f8ce70c0ee764dcb674c90c06eb1d2ad879966
-
SSDEEP
12288:z+Qf9NxkERr1JzrDTzz7wHxhW88KH6Yn77TCNp8jToZGrhR0Zz:Dx0j8KaYnfTYp8/oZMGZz
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe -
Executes dropped EXE 3 IoCs
pid Process 1940 winlogon.exe 3372 winlogon.exe 4572 winlogon.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" reg.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1940 set thread context of 3372 1940 winlogon.exe 91 PID 1940 set thread context of 4572 1940 winlogon.exe 92 -
resource yara_rule behavioral2/memory/3372-31-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/3372-35-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/3372-36-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/3372-34-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4572-49-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4572-46-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4572-45-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/4572-42-0x0000000000400000-0x0000000000409000-memory.dmp upx behavioral2/memory/3372-50-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/3372-51-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/3372-53-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/3372-56-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/3372-58-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/3372-74-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winlogon.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1844 reg.exe 1348 reg.exe 3272 reg.exe 1080 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 3372 winlogon.exe Token: SeCreateTokenPrivilege 3372 winlogon.exe Token: SeAssignPrimaryTokenPrivilege 3372 winlogon.exe Token: SeLockMemoryPrivilege 3372 winlogon.exe Token: SeIncreaseQuotaPrivilege 3372 winlogon.exe Token: SeMachineAccountPrivilege 3372 winlogon.exe Token: SeTcbPrivilege 3372 winlogon.exe Token: SeSecurityPrivilege 3372 winlogon.exe Token: SeTakeOwnershipPrivilege 3372 winlogon.exe Token: SeLoadDriverPrivilege 3372 winlogon.exe Token: SeSystemProfilePrivilege 3372 winlogon.exe Token: SeSystemtimePrivilege 3372 winlogon.exe Token: SeProfSingleProcessPrivilege 3372 winlogon.exe Token: SeIncBasePriorityPrivilege 3372 winlogon.exe Token: SeCreatePagefilePrivilege 3372 winlogon.exe Token: SeCreatePermanentPrivilege 3372 winlogon.exe Token: SeBackupPrivilege 3372 winlogon.exe Token: SeRestorePrivilege 3372 winlogon.exe Token: SeShutdownPrivilege 3372 winlogon.exe Token: SeDebugPrivilege 3372 winlogon.exe Token: SeAuditPrivilege 3372 winlogon.exe Token: SeSystemEnvironmentPrivilege 3372 winlogon.exe Token: SeChangeNotifyPrivilege 3372 winlogon.exe Token: SeRemoteShutdownPrivilege 3372 winlogon.exe Token: SeUndockPrivilege 3372 winlogon.exe Token: SeSyncAgentPrivilege 3372 winlogon.exe Token: SeEnableDelegationPrivilege 3372 winlogon.exe Token: SeManageVolumePrivilege 3372 winlogon.exe Token: SeImpersonatePrivilege 3372 winlogon.exe Token: SeCreateGlobalPrivilege 3372 winlogon.exe Token: 31 3372 winlogon.exe Token: 32 3372 winlogon.exe Token: 33 3372 winlogon.exe Token: 34 3372 winlogon.exe Token: 35 3372 winlogon.exe Token: SeDebugPrivilege 4572 winlogon.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1200 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe 1940 winlogon.exe 3372 winlogon.exe 3372 winlogon.exe 4572 winlogon.exe 3372 winlogon.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 1200 wrote to memory of 4728 1200 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe 85 PID 1200 wrote to memory of 4728 1200 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe 85 PID 1200 wrote to memory of 4728 1200 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe 85 PID 4728 wrote to memory of 5112 4728 cmd.exe 89 PID 4728 wrote to memory of 5112 4728 cmd.exe 89 PID 4728 wrote to memory of 5112 4728 cmd.exe 89 PID 1200 wrote to memory of 1940 1200 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe 90 PID 1200 wrote to memory of 1940 1200 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe 90 PID 1200 wrote to memory of 1940 1200 60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe 90 PID 1940 wrote to memory of 3372 1940 winlogon.exe 91 PID 1940 wrote to memory of 3372 1940 winlogon.exe 91 PID 1940 wrote to memory of 3372 1940 winlogon.exe 91 PID 1940 wrote to memory of 3372 1940 winlogon.exe 91 PID 1940 wrote to memory of 3372 1940 winlogon.exe 91 PID 1940 wrote to memory of 3372 1940 winlogon.exe 91 PID 1940 wrote to memory of 3372 1940 winlogon.exe 91 PID 1940 wrote to memory of 3372 1940 winlogon.exe 91 PID 1940 wrote to memory of 4572 1940 winlogon.exe 92 PID 1940 wrote to memory of 4572 1940 winlogon.exe 92 PID 1940 wrote to memory of 4572 1940 winlogon.exe 92 PID 1940 wrote to memory of 4572 1940 winlogon.exe 92 PID 1940 wrote to memory of 4572 1940 winlogon.exe 92 PID 1940 wrote to memory of 4572 1940 winlogon.exe 92 PID 1940 wrote to memory of 4572 1940 winlogon.exe 92 PID 1940 wrote to memory of 4572 1940 winlogon.exe 92 PID 3372 wrote to memory of 3628 3372 winlogon.exe 93 PID 3372 wrote to memory of 3628 3372 winlogon.exe 93 PID 3372 wrote to memory of 3628 3372 winlogon.exe 93 PID 3372 wrote to memory of 3344 3372 winlogon.exe 94 PID 3372 wrote to memory of 3344 3372 winlogon.exe 94 PID 3372 wrote to memory of 3344 3372 winlogon.exe 94 PID 3372 wrote to memory of 776 3372 winlogon.exe 95 PID 3372 wrote to memory of 776 3372 winlogon.exe 95 PID 3372 wrote to memory of 776 3372 winlogon.exe 95 PID 3372 wrote to memory of 224 3372 winlogon.exe 96 PID 3372 wrote to memory of 224 3372 winlogon.exe 96 PID 3372 wrote to memory of 224 3372 winlogon.exe 96 PID 3628 wrote to memory of 1348 3628 cmd.exe 101 PID 3628 wrote to memory of 1348 3628 cmd.exe 101 PID 3628 wrote to memory of 1348 3628 cmd.exe 101 PID 224 wrote to memory of 3272 224 cmd.exe 102 PID 224 wrote to memory of 3272 224 cmd.exe 102 PID 224 wrote to memory of 3272 224 cmd.exe 102 PID 3344 wrote to memory of 1080 3344 cmd.exe 103 PID 3344 wrote to memory of 1080 3344 cmd.exe 103 PID 3344 wrote to memory of 1080 3344 cmd.exe 103 PID 776 wrote to memory of 1844 776 cmd.exe 104 PID 776 wrote to memory of 1844 776 cmd.exe 104 PID 776 wrote to memory of 1844 776 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe"C:\Users\Admin\AppData\Local\Temp\60c0a1e3171459a4a8131d5def02d41f92346bb510892dee14f1f41d60c233d4N.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\polkd.bat" "2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Winlogon" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5112
-
-
-
C:\Users\Admin\AppData\Roaming\winlogon.exe"C:\Users\Admin\AppData\Roaming\winlogon.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Roaming\winlogon.exeC:\Users\Admin\AppData\Roaming\winlogon.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1348
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1080
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:1844
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\darkeye-nosttingspersistent2.exe:*:Enabled:Windows Messanger" /f5⤵
- Modifies firewall policy service
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:3272
-
-
-
-
C:\Users\Admin\AppData\Roaming\winlogon.exeC:\Users\Admin\AppData\Roaming\winlogon.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4572
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
138B
MD54da6717f2c70f4bd32ad33a227a2ff47
SHA13d7f7159e1f695bd469287d1ad4ffa0841b407a8
SHA256a12bb2e5d2fb0b3c400ce311fae72995a00b57a97d23e4b9effec47cff189d07
SHA5126765314054ad9bf2164058248f3d3a17775176925abbe4376aec030dca3a5e59be8b9e96139941fec2b2e1a9bff38f87abdb29ea09a299d8ab7e23ecec4083df
-
Filesize
1.5MB
MD597418670499522076ec69f6637663235
SHA1a8bbcec670be38f2fa4558bef01a023ccfe176cb
SHA256e3707b944599eea1a90b68f6af2abdc1cce0b1f17264cffc3cfdc0b0334bc348
SHA5129eff887f8120cefc6dcfc1b8514c321fc334e05e995e6555d07147fcc8c4958fa47f9ebd87d6d4deb7ba8c57fd0f2092ef83ee80f59c8ebf02be7f3dd289c4a3