4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d

General

Target
4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Size 205KB
Sample260910-vtvqjsshjh
SHA256 4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d
MD5 9bc309fe8fcb1f2a01198a79b4aedebd
SHA1 a2858bda6698aed37eb3bee459e5b35cd085d607
SHA512 447b33245f4433f31a1b166df314719298415f5758737bd7d010e2daa13f200909bcd3bd29673c82b496056059813ea1a2c5c2fb10526d56ea47f17abba79097
SSDEEP 3072:Tj9mD4Pa78AgZUUeXRHI2u4IM9HZ/RExJv9eBc4pfj5C0X3MEyf9A+d8ZeyXaOwo:TjYD4PawAJ1xI2CM9HQ/9j4F5CaMTJON
TLSH
T17824E1227BC4C13DF09686B11D3DA9B7EABFF5244F02426B23C4C7659DB1690AD0A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery persistence upx

Malware Config

Signatures

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Asynchronous = "1"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Impersonate = "1"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\StartShell = "EvWinLogon"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Logon = "EvWinLogon"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\Startup = "EvWinLogon"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlogon\DLLName = "wlogon.dll"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\wlogon.dll	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
File opened for modification	C:\Windows\SysWOW64\net.cpl	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
File opened for modification	C:\Windows\SysWOW64\lcss.exe	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
File opened for modification	C:\Windows\SysWOW64\crypto.dll	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2728-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/files/0x000800000002447a-6.dat	upx
behavioral1/memory/2728-26-0x0000000000400000-0x0000000000421000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ = "Windows Cryptography"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID\ = "{310DE29C-0AD3-4A43-A2DB-221F1160CACB}"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CLSID	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\CLSID	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ = "crypto.dll"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32\ThreadingModel = "Both"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID\ = "WinCryptography.Encrypt.1"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer\ = "WinCryptography.Encrypt.1"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\InprocServer32	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\ProgID	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\CurVer	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{310DE29C-0AD3-4A43-A2DB-221F1160CACB}\VersionIndependentProgID\ = "WinCryptography.Encrypt"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt\ = "Windows Cryptography"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WinCryptography.Encrypt.1\ = "Windows Cryptography"	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2728	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
Token: SeDebugPrivilege	2728	4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe

C:\Users\Admin\AppData\Local\Temp\4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe
"C:\Users\Admin\AppData\Local\Temp\4cfe4474cfc4418c198200dab681a0ddd21a028a55990b12dc6211ddb673dc9d.exe"
1⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

lcss.exe

Path C:\Windows\SysWOW64\lcss.exe
Size 218KB
SHA256 f07da7ccb2a048ec6600ce74b875908fde1eea28dcc692ffc3feb80211f7289d
MD5 411b9705c4574110cbed3ea634abac39
SHA1 a5152d04d2079034ad3776637b458f6c6ad49e60
SHA512 3c02f4cdd287ba940b51492a2f1722e7c26073867d1e03ea6439d706de8ede4143c197bfa0ac9d84e3e5e8e90b6a7a506bfc4e7c83a904bd6673f7de2b2de3f6
SSDEEP 6144:XI2CM9HsjYD4PawAJ19jrrTRampX/MqQJ:XrCaMZavjrZjn8
TLSH
T1EF24F1127AC8C03DF147CAB11E7E59B2EE3DB8244F11C65BA3D4D5698EF22909E0735A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.cpl

Path C:\Windows\SysWOW64\net.cpl
Size 137KB
SHA256 6e32916f6de4b29ab292c1e00f4c014a168ea09a2fa1157dc2cb423bebe44a06
MD5 a7fb320417597e979a141c35185c4e8c
SHA1 81c47c039b0d7a4efe19c016179d1cd26739a40c
SHA512 ddcde2e9bc129eaaf8b3b473d5a839fb5e86dc5d0c53c371027789c2ed3cdc9bc3e9383fa9e46b53277b287f8da99bf1c2e208ef24479f861074e9339e8e65a3
SSDEEP 3072:Tj9mD4Pa78AgZUUeXRHI2u4IM9HZnlMNlnWjcY:TjYD4PawAJ1xI2CM9H9lilnWgY
TLSH
T1A6D3C012BBC4C03DF04686B12D7D9EB3EA3FB9241F11865B23D4D6668DF16905E0A36B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2728-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2728-1-0x0000000000418000-0x0000000000419000-memory.dmp

Download

memory/2728-26-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads