Analysis
-
max time kernel
9s -
max time network
9s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
07-09-2020 08:19
Static task
static1
Behavioral task
behavioral1
Sample
bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
Errors
Reason
Machine shutdown
General
-
Target
bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe
-
Size
14KB
-
MD5
bdb77b2f35c0f3e79853ea7f8bdf5b29
-
SHA1
72de04ee453d053c98ee3047574b0cf6c23b0d33
-
SHA256
4d27264a659cc593d5c936a36942835450b97aacf12b7b1673dc1afc01b420ef
-
SHA512
c2bb90612d76c3f572c1c62c9ecb1abf9581aebfcf07f459ad79bc7910480e6f5628af8f1deed54162ad070d759b2f237cadd2ce17c21318f275e8793d06ae74
Score
8/10
Malware Config
Signatures
-
Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs
Enables rebooting of the machine without requiring login credentials.
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\Run = "C:\\Users\\Admin\\AppData\\Local\\Temp\\edny5ue0.ouc.exe" bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Modifies data under HKEY_USERS 20 IoCs
Processes:
svchost.exeLogonUI.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = a698bae50085d601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
svchost.exeshutdown.exedescription pid process Token: SeShutdownPrivilege 3332 svchost.exe Token: SeCreatePagefilePrivilege 3332 svchost.exe Token: SeShutdownPrivilege 1488 shutdown.exe Token: SeRemoteShutdownPrivilege 1488 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 2300 LogonUI.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
bdb77b2f35c0f3e79853ea7f8bdf5b29.in.execmd.exedescription pid process target process PID 788 wrote to memory of 2468 788 bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe cmd.exe PID 788 wrote to memory of 2468 788 bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe cmd.exe PID 2468 wrote to memory of 1488 2468 cmd.exe shutdown.exe PID 2468 wrote to memory of 1488 2468 cmd.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe"C:\Users\Admin\AppData\Local\Temp\bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qrladtxy.m1e.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown /f /r /t 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3aca055 /state1:0x41c64e6d1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\qrladtxy.m1e.bat
-
memory/788-0-0x00007FFE435A0000-0x00007FFE43F8C000-memory.dmpFilesize
9.9MB
-
memory/788-1-0x000002AF7EA40000-0x000002AF7EA41000-memory.dmpFilesize
4KB
-
memory/1488-5-0x0000000000000000-mapping.dmp
-
memory/2468-3-0x0000000000000000-mapping.dmp