a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 05:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040.exe
Size

237KB
MD5

29f49f034681c4e098ba78c3dc8dacff
SHA1

1ece71e0b3ec8f14d849272d8b859a38dccefb4f
SHA256

a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040
SHA512

b52d5ddeea6d3fdabf470c58c2b7f326c856a5c6f634615df2b3e49a62c816f3d0cc0717093745a4bc51beb1f92e1e198455af9764ddb92217532881186e9b79
SSDEEP

6144:9D8okEvTyoZVOgd2QZiw5NLclL5orfQHf:1sjCF2QZiOU+4f

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe,"	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
1784	svchost.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\f98bdf08 = "C:\\Windows\\apppatch\\svchost.exe"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\f98bdf08 = "C:\\Windows\\apppatch\\svchost.exe"	a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\apppatch\svchost.exe	a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040.exe
File opened for modification	C:\Windows\apppatch\svchost.exe	a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1784	svchost.exe
1784	svchost.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3696	a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 1784	3696	a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040.exe	85
PID 3696 wrote to memory of 1784	3696	a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040.exe	85
PID 3696 wrote to memory of 1784	3696	a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040.exe	85

C:\Users\Admin\AppData\Local\Temp\a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040.exe
"C:\Users\Admin\AppData\Local\Temp\a90cf066adb0be93122a20ee9dbb54a4479308c221cf26bfa3296a491d05f040.exe"
1⤵
- Modifies WinLogon
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\apppatch\svchost.exe
  "C:\Windows\apppatch\svchost.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies WinLogon
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\apppatch\svchost.exe

Filesize
237KB

MD5
ef811a04db6977db4abeff1e3595fd6e

SHA1
cabd1653336e9bcf5b8ec6eb28f258f158bca596

SHA256
8f15f416f545692412de7a7ad81592ae59d53b37d42153143f0f7c848048d40a

SHA512
da6f28965e245893af779079a7bb2b698e6225cd8ed7b2e8f1366a7ffdad1ddb5911bcbacaa12d43a7e6701522a6d8a06974ea093f81f9d1fa9eb3a0ccd29fe8

Download Submit
memory/1784-65-0x0000000003F50000-0x0000000003F51000-memory.dmp

Filesize
4KB

Download
memory/1784-62-0x0000000003F40000-0x0000000003F41000-memory.dmp

Filesize
4KB

Download
memory/1784-26-0x0000000003E50000-0x0000000003E51000-memory.dmp

Filesize
4KB

Download
memory/1784-27-0x0000000003E50000-0x0000000003E51000-memory.dmp

Filesize
4KB

Download
memory/1784-14-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1784-15-0x0000000002B70000-0x0000000002BFC000-memory.dmp

Filesize
560KB

Download
memory/1784-16-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1784-17-0x0000000002F40000-0x0000000002FDB000-memory.dmp

Filesize
620KB

Download
memory/1784-21-0x0000000002F40000-0x0000000002FDB000-memory.dmp

Filesize
620KB

Download
memory/1784-19-0x0000000002F40000-0x0000000002FDB000-memory.dmp

Filesize
620KB

Download
memory/1784-24-0x0000000003E40000-0x0000000003E41000-memory.dmp

Filesize
4KB

Download
memory/1784-51-0x0000000003EF0000-0x0000000003EF1000-memory.dmp

Filesize
4KB

Download
memory/1784-77-0x0000000003F90000-0x0000000003F91000-memory.dmp

Filesize
4KB

Download
memory/1784-79-0x0000000003FC0000-0x0000000003FC1000-memory.dmp

Filesize
4KB

Download
memory/1784-76-0x0000000003FA0000-0x0000000003FA1000-memory.dmp

Filesize
4KB

Download
memory/1784-72-0x0000000003F80000-0x0000000003F81000-memory.dmp

Filesize
4KB

Download
memory/1784-70-0x0000000003F60000-0x0000000003F61000-memory.dmp

Filesize
4KB

Download
memory/1784-69-0x0000000003F70000-0x0000000003F71000-memory.dmp

Filesize
4KB

Download
memory/1784-66-0x0000000003F60000-0x0000000003F61000-memory.dmp

Filesize
4KB

Download
memory/1784-28-0x0000000003E40000-0x0000000003E41000-memory.dmp

Filesize
4KB

Download
memory/1784-30-0x0000000003E60000-0x0000000003E61000-memory.dmp

Filesize
4KB

Download
memory/1784-59-0x0000000003F30000-0x0000000003F31000-memory.dmp

Filesize
4KB

Download
memory/1784-63-0x0000000003F30000-0x0000000003F31000-memory.dmp

Filesize
4KB

Download
memory/1784-58-0x0000000003F20000-0x0000000003F21000-memory.dmp

Filesize
4KB

Download
memory/1784-56-0x0000000003F00000-0x0000000003F01000-memory.dmp

Filesize
4KB

Download
memory/1784-55-0x0000000003F10000-0x0000000003F11000-memory.dmp

Filesize
4KB

Download
memory/1784-52-0x0000000003F00000-0x0000000003F01000-memory.dmp

Filesize
4KB

Download
memory/1784-49-0x0000000003ED0000-0x0000000003ED1000-memory.dmp

Filesize
4KB

Download
memory/1784-48-0x0000000003EE0000-0x0000000003EE1000-memory.dmp

Filesize
4KB

Download
memory/1784-44-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

Filesize
4KB

Download
memory/1784-42-0x0000000003EA0000-0x0000000003EA1000-memory.dmp

Filesize
4KB

Download
memory/1784-41-0x0000000003EB0000-0x0000000003EB1000-memory.dmp

Filesize
4KB

Download
memory/1784-38-0x0000000003EA0000-0x0000000003EA1000-memory.dmp

Filesize
4KB

Download
memory/1784-37-0x0000000003E90000-0x0000000003E91000-memory.dmp

Filesize
4KB

Download
memory/1784-35-0x0000000003E70000-0x0000000003E71000-memory.dmp

Filesize
4KB

Download
memory/1784-34-0x0000000003E80000-0x0000000003E81000-memory.dmp

Filesize
4KB

Download
memory/1784-31-0x0000000003E70000-0x0000000003E71000-memory.dmp

Filesize
4KB

Download
memory/3696-1-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3696-0-0x0000000002270000-0x00000000022D5000-memory.dmp

Filesize
404KB

Download
memory/3696-13-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/3696-12-0x0000000002270000-0x00000000022D5000-memory.dmp

Filesize
404KB

Download