15637f2d530662c968272c1e6e48ca6a093f0c828edf0cbb5cd32d9af03b3ff5

General

Target

winlogon.exe
Size

462KB
MD5

629f5bb8b5ee75e90c393ad9d96a1772
SHA1

b09925a7163bef858657a1b39146fe27abb01f99
SHA256

15637f2d530662c968272c1e6e48ca6a093f0c828edf0cbb5cd32d9af03b3ff5
SHA512

3434c0b1f42533c42a4232809a007ddfd340ebc0d500db436cd038e3d3b4aaf0fd8bcf36e3a1cee4442c5d894679f5cdc7cef5a90c04534f937121d6cc9e3857

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1088 616 WerFault.exe winlogon.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1744 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

winlogon.exeWerFault.exepowershell.exe

pid process

616 winlogon.exe
1088 WerFault.exe
1088 WerFault.exe
1088 WerFault.exe
1088 WerFault.exe
1088 WerFault.exe
240 powershell.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1088 WerFault.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

winlogon.exeWerFault.exepowershell.exe

description pid process

Token: SeDebugPrivilege 616 winlogon.exe
Token: SeDebugPrivilege 1088 WerFault.exe
Token: SeDebugPrivilege 240 powershell.exe

pid	pid_target	process	target process
1088	616	WerFault.exe	winlogon.exe

pid	process
1744	schtasks.exe

pid	process
616	winlogon.exe
1088	WerFault.exe
1088	WerFault.exe
1088	WerFault.exe
1088	WerFault.exe
1088	WerFault.exe
240	powershell.exe

pid	process
1088	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	616	winlogon.exe
Token: SeDebugPrivilege	1088	WerFault.exe
Token: SeDebugPrivilege	240	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

winlogon.exe

description	pid	process	target process
PID 616 wrote to memory of 240	616	winlogon.exe	powershell.exe
PID 616 wrote to memory of 240	616	winlogon.exe	powershell.exe
PID 616 wrote to memory of 240	616	winlogon.exe	powershell.exe
PID 616 wrote to memory of 240	616	winlogon.exe	powershell.exe
PID 616 wrote to memory of 1744	616	winlogon.exe	schtasks.exe
PID 616 wrote to memory of 1744	616	winlogon.exe	schtasks.exe
PID 616 wrote to memory of 1744	616	winlogon.exe	schtasks.exe
PID 616 wrote to memory of 1744	616	winlogon.exe	schtasks.exe
PID 616 wrote to memory of 1088	616	winlogon.exe	WerFault.exe
PID 616 wrote to memory of 1088	616	winlogon.exe	WerFault.exe
PID 616 wrote to memory of 1088	616	winlogon.exe	WerFault.exe
PID 616 wrote to memory of 1088	616	winlogon.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\winlogon.exe
"C:\Users\Admin\AppData\Local\Temp\winlogon.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:616

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\UlhpAjSuVoTa.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:240

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UlhpAjSuVoTa" /XML "C:\Users\Admin\AppData\Local\Temp\tmp70DC.tmp"
2⤵
- Creates scheduled task(s)
PID:1744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 616 -s 1012
2⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1088

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp70DC.tmp
MD5
7f3db492c6089b5f808bda9985dcbe00

SHA1
040c288fd15fe256f1efa306d9c9ce8e2be097f1

SHA256
2774c3611fc73d09b11bca9e0f2a9931804a4e178f6c02e9f359ce7ac17e0356

SHA512
a3ef55056a983a2a96658a9b98b624bbcdc9783ecf4960691039646179a8046b901b274c6b064afa326cf1f5433745c8b6ad3fbd786f386fb6270fd776583810

Download Submit
memory/240-61-0x0000000000000000-mapping.dmp

Download
memory/240-69-0x0000000002380000-0x0000000002FCA000-memory.dmp

Filesize
12.3MB

Download
memory/240-66-0x0000000002380000-0x0000000002FCA000-memory.dmp

Filesize
12.3MB

Download
memory/240-67-0x0000000002380000-0x0000000002FCA000-memory.dmp

Filesize
12.3MB

Download
memory/616-59-0x0000000004C80000-0x0000000004C81000-memory.dmp

Filesize
4KB

Download
memory/616-60-0x00000000050F0000-0x0000000005159000-memory.dmp

Filesize
420KB

Download
memory/616-55-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/616-58-0x0000000000310000-0x0000000000318000-memory.dmp

Filesize
32KB

Download
memory/616-57-0x0000000075971000-0x0000000075973000-memory.dmp

Filesize
8KB

Download
memory/1088-65-0x0000000000000000-mapping.dmp

Download
memory/1088-68-0x00000000004B0000-0x00000000004B1000-memory.dmp

Filesize
4KB

Download
memory/1744-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads