6b846c10ae14b07ae923408eb158871ccc8663164b8eefe28750b6c978dd3f92

General

Target

880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
Size

140KB
MD5

711486a19e8b011528dee34a5d25776e
SHA1

7e131940fce4d157d0a338b8285e8e2298e8677d
SHA256

880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c
SHA512

9213dc1b1ab70e6672e6bef43a50125e7752de303ddbdbfc5b395f3b228363dd57c036befb21c83945207954575b90021af0d4e1f6872253c20475f3dbc4e894

Score

10^/10

evasion persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty"	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe

Disables Task Manager via registry modification
evasion

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\desktop.ini	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Control Panel\Desktop\Wallpaper	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1520	3988	WerFault.exe	68

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3988	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
3988	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
3988	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
3988	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
3988	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
3988	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
3988	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
3988	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe
1520	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
Token: SeDebugPrivilege	1520	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe
"C:\Users\Admin\AppData\Local\Temp\880823dd9df0ca6047cd829a1031e8a167ccec0629fdeac40a097dd555debf7c.exe"
1⤵
- Modifies WinLogon for persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3988
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3988 -s 1236
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3988-115-0x00000000000F0000-0x0000000000118000-memory.dmp

Filesize
160KB

Download
memory/3988-116-0x000000001B680000-0x000000001B682000-memory.dmp

Filesize
8KB

Download
memory/3988-117-0x000000001B684000-0x000000001B685000-memory.dmp

Filesize
4KB

Download
memory/3988-118-0x000000001B682000-0x000000001B684000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads