f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

Target

[email protected]
Size

6.7MB
MD5

f2b7074e1543720a9a98fda660e02688
SHA1

1029492c1a12789d8af78d54adcb921e24b9e5ca
SHA256

4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966
SHA512

73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff

Score

8^/10

evasion persistence ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\B:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\F:	[email protected]
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\A:	[email protected]

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\Wallpaper	[email protected]

Kills process with taskkill 2 IoCs

evasion

pid	Process
960	taskkill.exe
2904	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	[email protected]

Suspicious use of AdjustPrivilegeToken 96 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	taskkill.exe
Token: SeDebugPrivilege	2904	taskkill.exe
Token: SeShutdownPrivilege	1200	[email protected]
Token: SeCreatePagefilePrivilege	1200	[email protected]
Token: SeIncreaseQuotaPrivilege	3724	WMIC.exe
Token: SeSecurityPrivilege	3724	WMIC.exe
Token: SeTakeOwnershipPrivilege	3724	WMIC.exe
Token: SeLoadDriverPrivilege	3724	WMIC.exe
Token: SeSystemProfilePrivilege	3724	WMIC.exe
Token: SeSystemtimePrivilege	3724	WMIC.exe
Token: SeProfSingleProcessPrivilege	3724	WMIC.exe
Token: SeIncBasePriorityPrivilege	3724	WMIC.exe
Token: SeCreatePagefilePrivilege	3724	WMIC.exe
Token: SeBackupPrivilege	3724	WMIC.exe
Token: SeRestorePrivilege	3724	WMIC.exe
Token: SeShutdownPrivilege	3724	WMIC.exe
Token: SeDebugPrivilege	3724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3724	WMIC.exe
Token: SeRemoteShutdownPrivilege	3724	WMIC.exe
Token: SeUndockPrivilege	3724	WMIC.exe
Token: SeManageVolumePrivilege	3724	WMIC.exe
Token: 33	3724	WMIC.exe
Token: 34	3724	WMIC.exe
Token: 35	3724	WMIC.exe
Token: 36	3724	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3724	WMIC.exe
Token: SeSecurityPrivilege	3724	WMIC.exe
Token: SeTakeOwnershipPrivilege	3724	WMIC.exe
Token: SeLoadDriverPrivilege	3724	WMIC.exe
Token: SeSystemProfilePrivilege	3724	WMIC.exe
Token: SeSystemtimePrivilege	3724	WMIC.exe
Token: SeProfSingleProcessPrivilege	3724	WMIC.exe
Token: SeIncBasePriorityPrivilege	3724	WMIC.exe
Token: SeCreatePagefilePrivilege	3724	WMIC.exe
Token: SeBackupPrivilege	3724	WMIC.exe
Token: SeRestorePrivilege	3724	WMIC.exe
Token: SeShutdownPrivilege	3724	WMIC.exe
Token: SeDebugPrivilege	3724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3724	WMIC.exe
Token: SeRemoteShutdownPrivilege	3724	WMIC.exe
Token: SeUndockPrivilege	3724	WMIC.exe
Token: SeManageVolumePrivilege	3724	WMIC.exe
Token: 33	3724	WMIC.exe
Token: 34	3724	WMIC.exe
Token: 35	3724	WMIC.exe
Token: 36	3724	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1444	WMIC.exe
Token: SeSecurityPrivilege	1444	WMIC.exe
Token: SeTakeOwnershipPrivilege	1444	WMIC.exe
Token: SeLoadDriverPrivilege	1444	WMIC.exe
Token: SeSystemProfilePrivilege	1444	WMIC.exe
Token: SeSystemtimePrivilege	1444	WMIC.exe
Token: SeProfSingleProcessPrivilege	1444	WMIC.exe
Token: SeIncBasePriorityPrivilege	1444	WMIC.exe
Token: SeCreatePagefilePrivilege	1444	WMIC.exe
Token: SeBackupPrivilege	1444	WMIC.exe
Token: SeRestorePrivilege	1444	WMIC.exe
Token: SeShutdownPrivilege	1444	WMIC.exe
Token: SeDebugPrivilege	1444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1444	WMIC.exe
Token: SeRemoteShutdownPrivilege	1444	WMIC.exe
Token: SeUndockPrivilege	1444	WMIC.exe
Token: SeManageVolumePrivilege	1444	WMIC.exe
Token: 33	1444	WMIC.exe
Token: 34	1444	WMIC.exe
Token: 35	1444	WMIC.exe
Token: 36	1444	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1444	WMIC.exe
Token: SeSecurityPrivilege	1444	WMIC.exe
Token: SeTakeOwnershipPrivilege	1444	WMIC.exe
Token: SeLoadDriverPrivilege	1444	WMIC.exe
Token: SeSystemProfilePrivilege	1444	WMIC.exe
Token: SeSystemtimePrivilege	1444	WMIC.exe
Token: SeProfSingleProcessPrivilege	1444	WMIC.exe
Token: SeIncBasePriorityPrivilege	1444	WMIC.exe
Token: SeCreatePagefilePrivilege	1444	WMIC.exe
Token: SeBackupPrivilege	1444	WMIC.exe
Token: SeRestorePrivilege	1444	WMIC.exe
Token: SeShutdownPrivilege	1444	WMIC.exe
Token: SeDebugPrivilege	1444	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1444	WMIC.exe
Token: SeRemoteShutdownPrivilege	1444	WMIC.exe
Token: SeUndockPrivilege	1444	WMIC.exe
Token: SeManageVolumePrivilege	1444	WMIC.exe
Token: 33	1444	WMIC.exe
Token: 34	1444	WMIC.exe
Token: 35	1444	WMIC.exe
Token: 36	1444	WMIC.exe
Token: SeShutdownPrivilege	1200	[email protected]
Token: SeCreatePagefilePrivilege	1200	[email protected]
Token: SeShutdownPrivilege	1200	[email protected]
Token: SeCreatePagefilePrivilege	1200	[email protected]
Token: SeShutdownPrivilege	1200	[email protected]
Token: SeCreatePagefilePrivilege	1200	[email protected]
Token: SeShutdownPrivilege	1200	[email protected]
Token: SeCreatePagefilePrivilege	1200	[email protected]

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1200	[email protected]
1200	[email protected]

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1084	1200	[email protected]	76
PID 1200 wrote to memory of 1084	1200	[email protected]	76
PID 1200 wrote to memory of 1084	1200	[email protected]	76
PID 1084 wrote to memory of 960	1084	cmd.exe	78
PID 1084 wrote to memory of 960	1084	cmd.exe	78
PID 1084 wrote to memory of 960	1084	cmd.exe	78
PID 1084 wrote to memory of 2904	1084	cmd.exe	79
PID 1084 wrote to memory of 2904	1084	cmd.exe	79
PID 1084 wrote to memory of 2904	1084	cmd.exe	79
PID 1084 wrote to memory of 3724	1084	cmd.exe	80
PID 1084 wrote to memory of 3724	1084	cmd.exe	80
PID 1084 wrote to memory of 3724	1084	cmd.exe	80
PID 1084 wrote to memory of 1444	1084	cmd.exe	82
PID 1084 wrote to memory of 1444	1084	cmd.exe	82
PID 1084 wrote to memory of 1444	1084	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Enumerates connected drives
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='UR NEXT'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3724
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'UR NEXT'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1444
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /f /r /t 0
    3⤵
    PID:3872

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad2055 /state1:0x41c64e6d
1⤵
PID:2888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1200-16-0x000000000B140000-0x000000000B150000-memory.dmp

Filesize
64KB

Download
memory/1200-15-0x000000000B140000-0x000000000B150000-memory.dmp

Filesize
64KB

Download
memory/1200-3-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/1200-9-0x0000000005F50000-0x0000000005F51000-memory.dmp

Filesize
4KB

Download
memory/1200-5-0x00000000064D0000-0x00000000064D1000-memory.dmp

Filesize
4KB

Download
memory/1200-14-0x000000000B0D0000-0x000000000B0D1000-memory.dmp

Filesize
4KB

Download
memory/1200-2-0x0000000073A70000-0x000000007415E000-memory.dmp

Filesize
6.9MB

Download
memory/1200-17-0x000000000B140000-0x000000000B150000-memory.dmp

Filesize
64KB

Download
memory/1200-18-0x000000000B140000-0x000000000B150000-memory.dmp

Filesize
64KB

Download
memory/1200-10-0x0000000005F53000-0x0000000005F55000-memory.dmp

Filesize
8KB

Download
memory/1200-21-0x000000000B9D0000-0x000000000B9E0000-memory.dmp

Filesize
64KB

Download
memory/1200-20-0x000000000B9D0000-0x000000000B9E0000-memory.dmp

Filesize
64KB

Download
memory/1200-22-0x000000000B140000-0x000000000B150000-memory.dmp

Filesize
64KB

Download
memory/1200-23-0x000000000B140000-0x000000000B150000-memory.dmp

Filesize
64KB

Download
memory/1200-24-0x000000000B9D0000-0x000000000B9E0000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads