501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c

General

Target

501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe
Size

4.2MB
MD5

07f8195a0f98d7d734bf21cb2b46e0ab
SHA1

cb589f3e827e5a56c689165948fa7b2d70658e6c
SHA256

501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c
SHA512

40c8523596e461427e4f3e070ad6c31e9634995b5a6761446b1af448b30cf0d1787538f97bcaea480a54475cc06aa8aaf3aa8c749bbb3887cf40038a6fe5ecfc
SSDEEP

98304:ECjPKNA1vv3LuCZFJwHOVjGE2nzaTZwOw5qBs9J9:ECbGAdPLuCHu0GEOzUKOns9T

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "%AppData%\\Microsoft\\winlogon.exe,explorer.exe"	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Adobe Reader = "%AppData%\\Microsoft\\winlogon.exe"	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe Reader = "%AppData%\\Microsoft\\winlogon.exe"	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

description	pid	process	target process
PID 1972 set thread context of 960	1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

pid	process
1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe
1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe
1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe
1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

pid	process
1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe
1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe
1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe
1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe

description	pid	process	target process
PID 1972 wrote to memory of 960	1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe	svchost.exe
PID 1972 wrote to memory of 960	1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe	svchost.exe
PID 1972 wrote to memory of 960	1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe	svchost.exe
PID 1972 wrote to memory of 960	1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe	svchost.exe
PID 1972 wrote to memory of 960	1972	501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe	svchost.exe

C:\Users\Admin\AppData\Local\Temp\501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe
"C:\Users\Admin\AppData\Local\Temp\501140cf4e9b12b9c222ecfc46a94a0c9cf0d88392ece4e7518bf6bbc1ca129c.exe"
1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1972