84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc

General

Target
84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Size 212KB
Sample260903-ldr52stdkg
SHA256 84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc
MD5 57d9c4e5983f9f745ec4cf2b21d6c758
SHA1 efd76b156fed362c809d5ce3c30057ebb964cc7c
SHA512 bbb96a8b0b302d57b4e2d5e1c9fb2a3a2b5e7dc1e5d2359bf8bbcac920ac3d804daff454bec8d08c9158cb90184e2bc01f8d262bc56a3d1dad0b465bf4d3a305
SSDEEP 6144:fjYD4PawAJ1VI2sa7pKDfQpUZf3stt8puZOfA9a:fZaXrsCADfOUV8gpeE
TLSH
T14A24F10276D4C03DE15A49F02D3D69F3EA3EBD244F1199BB13A4E5768EB61C09D0A367
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence upx

Malware Config

Signatures

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wlogon.dll	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
File opened for modification	C:\Windows\SysWOW64\net.cpl	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
File opened for modification	C:\Windows\SysWOW64\lcss.exe	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
File opened for modification	C:\Windows\SysWOW64\crypto.dll	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4072-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/files/0x00080000000245c0-6.dat	upx
behavioral1/memory/4072-26-0x0000000000400000-0x0000000000421000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4072	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
Token: SeDebugPrivilege	4072	84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe

C:\Users\Admin\AppData\Local\Temp\84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe
"C:\Users\Admin\AppData\Local\Temp\84d13dd5018e03e5fc253ee09ad43c42b70800d2143507e8ccdbc3c37ecf5acc.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lcss.exe

Path C:\Windows\SysWOW64\lcss.exe
Size 145KB
SHA256 fd7ee57f8ac55390431c33e85abe09c3324ef89c073e08a8b2b7ae995e69dab8
MD5 3d4677d4cc6a6896dab7d13d81a8b777
SHA1 88827146c26dce9ae5014908ecd966b06ed51faa
SHA512 d3f1423ff76987f424c98a255a50ff403882ea0e16aef6d49e990bc1863e9faed380cefef755fe9831b0c6979c0c50ecee7c541d40c6ca182d5651c923971ede
SSDEEP 3072:nHI2uza789jj9mD4Pa78AgZUUeXrsyuQXaCr00:HI2sa7ajYD4PawAJ1wyuQTr00
TLSH
T16FE3D01277C8C03EF04686F11D7D5AF3E97EF9240F52469B13D4D66A8EB1290AD0A36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.cpl

Path C:\Windows\SysWOW64\net.cpl
Size 216KB
SHA256 245ae5352f8ef5081565c555daf65aaef7b77f3bbea453e807c4eed558736760
MD5 2b8357e22744303588969444e17f433f
SHA1 ab329e2b4a621df04fa89eae2195e7f45279b648
SHA512 1491bf42f68c781c9f9a6dfea65410b0696cf4965b324dc223000be0385539bee8b653d9a2712b6ad3363f1f7a7a18de2fb68b6fd354bc7f1e76aa2fb26ff1c2
SSDEEP 6144:fjYD4PawAJ1VI2sa7cX1l1Ge1RJtEDFmX5j:fZaXrsCisiGFmR
TLSH
T1EE2401227BD4C03DF4A68AB15C7CA9B6E57EBD300F42869B13E4D1768DF22509D0639B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4072-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4072-1-0x0000000000418000-0x0000000000419000-memory.dmp

Download

memory/4072-26-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads