15637f2d530662c968272c1e6e48ca6a093f0c828edf0cbb5cd32d9af03b3ff5

General

Target

tmp/.winlogon.exe
Size

462KB
MD5

629f5bb8b5ee75e90c393ad9d96a1772
SHA1

b09925a7163bef858657a1b39146fe27abb01f99
SHA256

15637f2d530662c968272c1e6e48ca6a093f0c828edf0cbb5cd32d9af03b3ff5
SHA512

3434c0b1f42533c42a4232809a007ddfd340ebc0d500db436cd038e3d3b4aaf0fd8bcf36e3a1cee4442c5d894679f5cdc7cef5a90c04534f937121d6cc9e3857

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1036 1112 WerFault.exe .winlogon.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1608 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

.winlogon.exepowershell.exeWerFault.exe

pid process

1112 .winlogon.exe
1112 .winlogon.exe
1376 powershell.exe
1036 WerFault.exe
1036 WerFault.exe
1036 WerFault.exe
1036 WerFault.exe
1036 WerFault.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

.winlogon.exepowershell.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1112 .winlogon.exe
Token: SeDebugPrivilege 1376 powershell.exe
Token: SeDebugPrivilege 1036 WerFault.exe

pid	pid_target	process	target process
1036	1112	WerFault.exe	.winlogon.exe

pid	process
1608	schtasks.exe

pid	process
1112	.winlogon.exe
1112	.winlogon.exe
1376	powershell.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe
1036	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1112	.winlogon.exe
Token: SeDebugPrivilege	1376	powershell.exe
Token: SeDebugPrivilege	1036	WerFault.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

.winlogon.exe

description	pid	process	target process
PID 1112 wrote to memory of 1376	1112	.winlogon.exe	powershell.exe
PID 1112 wrote to memory of 1376	1112	.winlogon.exe	powershell.exe
PID 1112 wrote to memory of 1376	1112	.winlogon.exe	powershell.exe
PID 1112 wrote to memory of 1376	1112	.winlogon.exe	powershell.exe
PID 1112 wrote to memory of 1608	1112	.winlogon.exe	schtasks.exe
PID 1112 wrote to memory of 1608	1112	.winlogon.exe	schtasks.exe
PID 1112 wrote to memory of 1608	1112	.winlogon.exe	schtasks.exe
PID 1112 wrote to memory of 1608	1112	.winlogon.exe	schtasks.exe
PID 1112 wrote to memory of 1036	1112	.winlogon.exe	WerFault.exe
PID 1112 wrote to memory of 1036	1112	.winlogon.exe	WerFault.exe
PID 1112 wrote to memory of 1036	1112	.winlogon.exe	WerFault.exe
PID 1112 wrote to memory of 1036	1112	.winlogon.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\tmp\.winlogon.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\.winlogon.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1112

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UlhpAjSuVoTa.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UlhpAjSuVoTa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9369.tmp"
2⤵
- Creates scheduled task(s)
PID:1608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 1016
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1036

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9369.tmp
MD5
7f3db492c6089b5f808bda9985dcbe00

SHA1
040c288fd15fe256f1efa306d9c9ce8e2be097f1

SHA256
2774c3611fc73d09b11bca9e0f2a9931804a4e178f6c02e9f359ce7ac17e0356

SHA512
a3ef55056a983a2a96658a9b98b624bbcdc9783ecf4960691039646179a8046b901b274c6b064afa326cf1f5433745c8b6ad3fbd786f386fb6270fd776583810

Download Submit
memory/1036-65-0x0000000000000000-mapping.dmp

Download
memory/1112-55-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Filesize
4KB

Download
memory/1112-57-0x0000000075801000-0x0000000075803000-memory.dmp

Filesize
8KB

Download
memory/1112-58-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/1112-59-0x0000000000390000-0x0000000000398000-memory.dmp

Filesize
32KB

Download
memory/1112-60-0x0000000004F30000-0x0000000004F99000-memory.dmp

Filesize
420KB

Download
memory/1376-61-0x0000000000000000-mapping.dmp

Download
memory/1376-66-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/1376-67-0x0000000002431000-0x0000000002432000-memory.dmp

Filesize
4KB

Download
memory/1608-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads