2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93

General

Target
2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Size 183KB
Sample260910-k2he3stxbz
SHA256 2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93
MD5 93b7cc77c72e6830a2b5c09b0c9baf7a
SHA1 80dc1f867667cf80ed77f229d8886f862f427e7f
SHA512 1c602aa28acc1ce5c525fb297c8275d477a657369b052e2ca61aef7004f6db29b586829fe7fff869033f91b56d9a67c10d862e8df631465cc9a825f41d0b1c87
SSDEEP 3072:Tj9mD4Pa78AgZUUeXRHI2u4IM9nOBWyoecglifGezKmEWDJcrbVRQtTUP0Ry9XLw:TjYD4PawAJ1xI2CM9nuzcgYffKacrBRk
TLSH
T14804F112BB88C039F5C642F06D7D68BBE67DF9240F4283AB53D496768DF5250AE06317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence upx

Malware Config

Signatures

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\crypto.dll	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
File opened for modification	C:\Windows\SysWOW64\wlogon.dll	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
File opened for modification	C:\Windows\SysWOW64\net.cpl	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
File opened for modification	C:\Windows\SysWOW64\lcss.exe	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2160-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/files/0x000900000002442a-6.dat	upx
behavioral1/memory/2160-26-0x0000000000400000-0x0000000000421000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1"	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2160	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
Token: SeDebugPrivilege	2160	2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe

C:\Users\Admin\AppData\Local\Temp\2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe
"C:\Users\Admin\AppData\Local\Temp\2078de810645b0c55debcae31fd1ad894afd079907a816de6e7907937a538d93.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lcss.exe

Path C:\Windows\SysWOW64\lcss.exe
Size 165KB
SHA256 e6f6bdf82069dff3fd911e4f90b0d2e5a752781d452f0f44ab0aad9c8932c4d5
MD5 ef1cb7608af912c37941aebbe500239e
SHA1 615c59762261ec92014b06ba3770ee7a2ab56653
SHA512 9a1b8582ad5eea2d0bdefecae60200f6d2349c3f9f19e36cf1797fda696be75c1a7e612026a482449845b66f6d9ab7a829b9e08ec4b9bca4aa38dbcb3555c809
SSDEEP 3072:XHI2u4IM9nOBoj9mD4Pa78AgZUUeXk85q6rUTzQPSRRz2V3rL:XI2CM9n5jYD4PawAJ1k85gAKRW7L
TLSH
T194F3E002BBD0C13EF15A86B02D7E96B7E67EF9340F62416713D0D66A4DF62509D0632B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.cpl

Path C:\Windows\SysWOW64\net.cpl
Size 125KB
SHA256 ee563974b4f41094f1dee8de684b72249bb5ee816e1772194517bddfdbc017b4
MD5 297fc9f444aef7b5c96d0cce5f1990cd
SHA1 04722d6abce730877e3f0d2424f18548346a08f7
SHA512 5a248bf12b2670e2838a8a26fbf362d90b1f29422c1406f05a04f9e47057195f68442d68eb3bc7599876bf2d3052580c6cbec607cde56acfcb31db95f597cb10
SSDEEP 3072:Tj9mD4Pa78AgZUUeXRHI2u4IM9nOBRq6fjdWzzg:TjYD4PawAJ1xI2CM9nGhjJ
TLSH
T19AC3CF127BC4C03EF086C6F11D7D59F3EA7EB8240F52819B2394D6699DF6290AE0635B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2160-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2160-1-0x0000000000418000-0x0000000000419000-memory.dmp

Download

memory/2160-26-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads