5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170.exe
Size

129KB
MD5

4fcc3fdc3960f40dcecfc6fff02738ef
SHA1

dcc5c4562c952c31f80cc32843b24bc32b3617a7
SHA256

5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170
SHA512

5c6bf1dcca32425c9d3259fae88011bfe3c85e09624d8d84d6729d422fce02ae19e177a2e5de53917247aeb28824d7bf7d49e82b8fbf3645b6e78746fc803095
SSDEEP

3072:p8qlbOAxQFH9JPcQl1Q5brufmA6HVTIdddj1s6ElECDd:LbOAIXNl1Qp1J1TIdddj1snE8

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\vwjthuxp\\edbgrueg.exe"	svchost.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe
2004	viybtwgmbplcoxgp.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edbgrueg.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\edbgrueg.exe	svchost.exe

Loads dropped DLL 6 IoCs

pid	Process
1492	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170.exe
1492	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170.exe
1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe
1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe
1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe
1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\EdbGrueg = "C:\\Users\\Admin\\AppData\\Local\\vwjthuxp\\edbgrueg.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe
540	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe
Token: SeDebugPrivilege	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe
Token: SeSecurityPrivilege	1376	svchost.exe
Token: SeSecurityPrivilege	540	svchost.exe
Token: SeDebugPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeSecurityPrivilege	2004	viybtwgmbplcoxgp.exe
Token: SeLoadDriverPrivilege	2004	viybtwgmbplcoxgp.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe
Token: SeBackupPrivilege	540	svchost.exe
Token: SeRestorePrivilege	540	svchost.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1748	1492	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170.exe	27
PID 1492 wrote to memory of 1748	1492	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170.exe	27
PID 1492 wrote to memory of 1748	1492	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170.exe	27
PID 1492 wrote to memory of 1748	1492	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170.exe	27
PID 1748 wrote to memory of 1376	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	28
PID 1748 wrote to memory of 1376	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	28
PID 1748 wrote to memory of 1376	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	28
PID 1748 wrote to memory of 1376	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	28
PID 1748 wrote to memory of 1376	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	28
PID 1748 wrote to memory of 1376	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	28
PID 1748 wrote to memory of 1376	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	28
PID 1748 wrote to memory of 1376	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	28
PID 1748 wrote to memory of 1376	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	28
PID 1748 wrote to memory of 1376	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	28
PID 1748 wrote to memory of 540	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	29
PID 1748 wrote to memory of 540	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	29
PID 1748 wrote to memory of 540	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	29
PID 1748 wrote to memory of 540	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	29
PID 1748 wrote to memory of 540	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	29
PID 1748 wrote to memory of 540	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	29
PID 1748 wrote to memory of 540	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	29
PID 1748 wrote to memory of 540	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	29
PID 1748 wrote to memory of 540	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	29
PID 1748 wrote to memory of 540	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	29
PID 1748 wrote to memory of 2004	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	30
PID 1748 wrote to memory of 2004	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	30
PID 1748 wrote to memory of 2004	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	30
PID 1748 wrote to memory of 2004	1748	5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe	30

C:\Users\Admin\AppData\Local\Temp\5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170.exe
"C:\Users\Admin\AppData\Local\Temp\5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe
  C:\Users\Admin\AppData\Local\Temp\5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Checks BIOS information in registry
    - Drops startup file
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\viybtwgmbplcoxgp.exe
    "C:\Users\Admin\AppData\Local\Temp\viybtwgmbplcoxgp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2004

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe

Filesize
109KB

MD5
23dcf284359d24e3fbee7741c80f246d

SHA1
da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3

SHA256
989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2

SHA512
4a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d

Download Submit
C:\Users\Admin\AppData\Local\Temp\5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe

Filesize
109KB

MD5
23dcf284359d24e3fbee7741c80f246d

SHA1
da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3

SHA256
989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2

SHA512
4a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d

Download Submit
C:\Users\Admin\AppData\Local\Temp\viybtwgmbplcoxgp.exe

Filesize
109KB

MD5
23dcf284359d24e3fbee7741c80f246d

SHA1
da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3

SHA256
989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2

SHA512
4a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d

Download Submit
C:\Users\Admin\AppData\Local\Temp\viybtwgmbplcoxgp.exe

Filesize
109KB

MD5
23dcf284359d24e3fbee7741c80f246d

SHA1
da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3

SHA256
989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2

SHA512
4a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d

Download Submit
\Users\Admin\AppData\Local\Temp\5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe

Filesize
109KB

MD5
23dcf284359d24e3fbee7741c80f246d

SHA1
da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3

SHA256
989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2

SHA512
4a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d

Download Submit
\Users\Admin\AppData\Local\Temp\5f2f873e60a22cf47ece5da0f1b98be79edca639e94769427f97d4904a817170mgr.exe

Filesize
109KB

MD5
23dcf284359d24e3fbee7741c80f246d

SHA1
da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3

SHA256
989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2

SHA512
4a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d

Download Submit
\Users\Admin\AppData\Local\Temp\viybtwgmbplcoxgp.exe

Filesize
109KB

MD5
23dcf284359d24e3fbee7741c80f246d

SHA1
da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3

SHA256
989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2

SHA512
4a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d

Download Submit
\Users\Admin\AppData\Local\Temp\viybtwgmbplcoxgp.exe

Filesize
109KB

MD5
23dcf284359d24e3fbee7741c80f246d

SHA1
da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3

SHA256
989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2

SHA512
4a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d

Download Submit
\Users\Admin\AppData\Local\Temp\viybtwgmbplcoxgp.exe

Filesize
109KB

MD5
23dcf284359d24e3fbee7741c80f246d

SHA1
da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3

SHA256
989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2

SHA512
4a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d

Download Submit
\Users\Admin\AppData\Local\Temp\viybtwgmbplcoxgp.exe

Filesize
109KB

MD5
23dcf284359d24e3fbee7741c80f246d

SHA1
da45f93fe6c380c9f4b8b6dbba7943cf8b3688b3

SHA256
989006203c54720a6f43a83c597aa2564db9b77f4df2b6ff2ba772db0109deb2

SHA512
4a70bab783505c246f5a37dbce77a0529bf7c467c9c3f52e9edbef55fd36b735f64bc069ee3cde6939586f605daf895be90dc3604b40fa375b6a023568f2375d

Download Submit
memory/540-76-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/540-72-0x0000000020010000-0x0000000020023000-memory.dmp

Filesize
76KB

Download
memory/1376-63-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1376-66-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download
memory/1492-59-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/1748-80-0x0000000000400000-0x0000000000437A70-memory.dmp

Filesize
222KB

Download
memory/2004-89-0x0000000000400000-0x0000000000437A70-memory.dmp

Filesize
222KB

Download
memory/2004-90-0x0000000000400000-0x0000000000437A70-memory.dmp

Filesize
222KB

Download