e10cb7d36b757ce8925ae85fa3c2163df542b98866e06468b54abc9c4c9c05d0

Analysis

max time kernel
33s
max time network
35s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2024, 13:26

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Client.exe
Size

608KB
MD5

39727583da3ec4b5a2c90f3d098b79fc
SHA1

a2ebefa269b3462f7a85b7af2188ede8ed4f0aac
SHA256

e10cb7d36b757ce8925ae85fa3c2163df542b98866e06468b54abc9c4c9c05d0
SHA512

12c0d9dbd63259cb19cf70b765faf0c6220a3ee8ef6ad7ec6e7638ac4a07c2b701a92e19b8af4a1e859f2b34df159c316653e89ff77b214c71beb5d71170c2a3
SSDEEP

6144:KnR9gbQETjrVwuR7V5Ew1w6Ici19/e6VlWT8b9khzaiMuz3KVjbI4R6SqBUiTVVo:G8bQSVEw14fPVle8Sqvx6Sqx

Score

10^/10

credential_access discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Users\\Admin\\xdwdMicrosoft Excel Host.exe"	Client.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Client.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Loads dropped DLL 6 IoCs

pid	Process
3716	Process not Found
4168	WmiApSrv.exe
1512	Process not Found
2796	Process not Found
2652	shutdown.exe
5012	LogonUI.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	Client.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "218"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3388	schtasks.exe
3220	schtasks.exe
4780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
4168	WmiApSrv.exe
4168	WmiApSrv.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe
2228	Client.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	Client.exe
Token: SeShutdownPrivilege	2652	shutdown.exe
Token: SeRemoteShutdownPrivilege	2652	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5012	LogonUI.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 4008	2228	Client.exe	89
PID 2228 wrote to memory of 4008	2228	Client.exe	89
PID 4008 wrote to memory of 3220	4008	CMD.exe	91
PID 4008 wrote to memory of 3220	4008	CMD.exe	91
PID 2228 wrote to memory of 2408	2228	Client.exe	93
PID 2228 wrote to memory of 2408	2228	Client.exe	93
PID 2408 wrote to memory of 4780	2408	CMD.exe	95
PID 2408 wrote to memory of 4780	2408	CMD.exe	95
PID 2228 wrote to memory of 3148	2228	Client.exe	96
PID 2228 wrote to memory of 3148	2228	Client.exe	96
PID 3148 wrote to memory of 3388	3148	CMD.exe	98
PID 3148 wrote to memory of 3388	3148	CMD.exe	98
PID 2228 wrote to memory of 3528	2228	Client.exe	101
PID 2228 wrote to memory of 3528	2228	Client.exe	101
PID 3528 wrote to memory of 2652	3528	cmd.exe	104
PID 3528 wrote to memory of 2652	3528	cmd.exe	104

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "SecurityHealthSystray.exe" /tr "C:\Users\Admin\xdwdMicrosoft Excel Host.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "SecurityHealthSystray.exe" /tr "C:\Users\Admin\xdwdMicrosoft Excel Host.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3220
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\xdwdMicrosoft Excel Host.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\xdwdMicrosoft Excel Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4780
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\Documents\xdwdCitrix Receiver.exe" /RL HIGHEST & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "SecurityHealthSystray" /tr "C:\Users\Admin\Documents\xdwdCitrix Receiver.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Shutdown /s /f /t 00
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\system32\shutdown.exe
    Shutdown /s /f /t 00
    3⤵
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:2652

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4168

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3945055 /state1:0x41c64e6d
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/2228-0-0x00007FF8C10F3000-0x00007FF8C10F5000-memory.dmp

Filesize
8KB

Download
memory/2228-1-0x0000000000140000-0x00000000001DE000-memory.dmp

Filesize
632KB

Download
memory/2228-2-0x00007FF8C10F3000-0x00007FF8C10F5000-memory.dmp

Filesize
8KB

Download
memory/2228-18-0x00007FF8C10F0000-0x00007FF8C1BB1000-memory.dmp

Filesize
10.8MB

Download
memory/2228-106-0x0000000000B20000-0x0000000000B2C000-memory.dmp

Filesize
48KB

Download
memory/2228-105-0x000000001D7E0000-0x000000001D856000-memory.dmp

Filesize
472KB

Download
memory/2228-107-0x00000000023A0000-0x00000000023BE000-memory.dmp

Filesize
120KB

Download
memory/2228-138-0x00007FF8C10F0000-0x00007FF8C1BB1000-memory.dmp

Filesize
10.8MB

Download
memory/2228-169-0x0000000000B40000-0x0000000000B48000-memory.dmp

Filesize
32KB

Download
memory/2228-173-0x00007FF8C10F0000-0x00007FF8C1BB1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads