6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8

Analysis

max time kernel
60s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 16:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe
Size

947KB
MD5

5fc51b17977c56d7158e744f254bb2fa
SHA1

a9197dc78760886546d386ec7f5b0b253b1cb86f
SHA256

6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8
SHA512

9f718873df048898e2186ec85e79eedbecc773935471d91a0e8c70603be7683f8cbdf2a611fb90801736470cb4e7d417df9dc1c635204f8e3bce924b7bfca8c0
SSDEEP

24576:ZhpOrzcwXRXk96ZcoexPoHhYBssWTmpA:ZSNXtkEcoGgGW6pA

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\FolderName\\file.exe"	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe

Executes dropped EXE 1 IoCs

Processes:

notepad .exe

pid process

1912 notepad .exe

pid	process
1912	notepad .exe

Drops startup file 2 IoCs

Processes:

cmd.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.exe	cmd.exe

Loads dropped DLL 6 IoCs

Processes:

6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exeWerFault.exe

pid	process
2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe
1256	WerFault.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe

description	pid	process	target process
PID 2028 set thread context of 1912	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	notepad .exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1256 1912 WerFault.exe notepad .exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

624 timeout.exe

pid	pid_target	process	target process
1256	1912	WerFault.exe	notepad .exe

pid	process
624	timeout.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe

pid	process
2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe
2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe
2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe

description pid process

Token: SeDebugPrivilege 2028 6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe

description	pid	process
Token: SeDebugPrivilege	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.execmd.exenotepad .exewscript.execmd.exe

description	pid	process	target process
PID 2028 wrote to memory of 1272	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	cmd.exe
PID 2028 wrote to memory of 1272	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	cmd.exe
PID 2028 wrote to memory of 1272	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	cmd.exe
PID 2028 wrote to memory of 1272	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	cmd.exe
PID 2028 wrote to memory of 1912	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	notepad .exe
PID 2028 wrote to memory of 1912	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	notepad .exe
PID 2028 wrote to memory of 1912	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	notepad .exe
PID 2028 wrote to memory of 1912	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	notepad .exe
PID 2028 wrote to memory of 1912	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	notepad .exe
PID 2028 wrote to memory of 1912	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	notepad .exe
PID 2028 wrote to memory of 1912	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	notepad .exe
PID 2028 wrote to memory of 1912	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	notepad .exe
PID 1272 wrote to memory of 1916	1272	cmd.exe	wscript.exe
PID 1272 wrote to memory of 1916	1272	cmd.exe	wscript.exe
PID 1272 wrote to memory of 1916	1272	cmd.exe	wscript.exe
PID 1272 wrote to memory of 1916	1272	cmd.exe	wscript.exe
PID 1912 wrote to memory of 1256	1912	notepad .exe	WerFault.exe
PID 1912 wrote to memory of 1256	1912	notepad .exe	WerFault.exe
PID 1912 wrote to memory of 1256	1912	notepad .exe	WerFault.exe
PID 1912 wrote to memory of 1256	1912	notepad .exe	WerFault.exe
PID 1916 wrote to memory of 544	1916	wscript.exe	cmd.exe
PID 1916 wrote to memory of 544	1916	wscript.exe	cmd.exe
PID 1916 wrote to memory of 544	1916	wscript.exe	cmd.exe
PID 1916 wrote to memory of 544	1916	wscript.exe	cmd.exe
PID 2028 wrote to memory of 396	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	cmd.exe
PID 2028 wrote to memory of 396	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	cmd.exe
PID 2028 wrote to memory of 396	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	cmd.exe
PID 2028 wrote to memory of 396	2028	6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe	cmd.exe
PID 396 wrote to memory of 624	396	cmd.exe	timeout.exe
PID 396 wrote to memory of 624	396	cmd.exe	timeout.exe
PID 396 wrote to memory of 624	396	cmd.exe	timeout.exe
PID 396 wrote to memory of 624	396	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe
"C:\Users\Admin\AppData\Local\Temp\6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8.exe"
1⤵
- Modifies WinLogon for persistence
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\FolderName\mata.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\FolderName\invs.vbs" "C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat" "
4⤵
- Drops startup file
PID:544

C:\Users\Admin\AppData\Local\Temp\notepad .exe
"C:\Users\Admin\AppData\Local\Temp\notepad .exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 144
3⤵
- Loads dropped DLL
- Program crash
PID:1256

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\FolderName\stres.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:396

C:\Windows\SysWOW64\timeout.exe
timeout /t 300
3⤵
- Delays execution with timeout.exe
PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\FolderName\file.exe

Filesize
947KB

MD5
5fc51b17977c56d7158e744f254bb2fa

SHA1
a9197dc78760886546d386ec7f5b0b253b1cb86f

SHA256
6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8

SHA512
9f718873df048898e2186ec85e79eedbecc773935471d91a0e8c70603be7683f8cbdf2a611fb90801736470cb4e7d417df9dc1c635204f8e3bce924b7bfca8c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\FolderName\invs.vbs

Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\FolderName\mata.bat

Filesize
69B

MD5
c96a3b31fc4a115c977ce5d8a3256f4f

SHA1
8c71b0d75099af30ac1fe33266e3970b47ba716d

SHA256
a5b672a4863abcf46556d2e606b2833e8897a3206e554ad93043a82a792df49e

SHA512
f4337e85ca0b3c0242c35a09f1ff7154c9e37ea3c7de3c2337385fb4b57e25a8550877ce2f37d023c94a3fa69b2b4e003207790297879d29a5bbe4856d0a0f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\FolderName\mata2.bat

Filesize
176B

MD5
b77f8e41f69f39412b204cc781212baa

SHA1
38d70fce7d44d1935955cf4b519664c7969d5989

SHA256
05ebddcab0758b634954345905825e611eed207bbbb989e6dded1e3476e5deab

SHA512
8b404359b8c854822fb97262c55dad5293a75d353ba2a2210840c9fbbea96e3ff985856601bb6ca4d10bc21effb3af33558e0c2d9c90128133ae35fe09dccb61

Download Submit
C:\Users\Admin\AppData\Local\Temp\FolderName\rundll11-.txt

Filesize
947KB

MD5
5fc51b17977c56d7158e744f254bb2fa

SHA1
a9197dc78760886546d386ec7f5b0b253b1cb86f

SHA256
6b4d9956d8b5dbc50c6346c011f82e708f4722f558739cac6b2ca6d2c46e0bd8

SHA512
9f718873df048898e2186ec85e79eedbecc773935471d91a0e8c70603be7683f8cbdf2a611fb90801736470cb4e7d417df9dc1c635204f8e3bce924b7bfca8c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\FolderName\stres.bat

Filesize
211B

MD5
fcea7e008224fa9f82bba83e3562baf0

SHA1
f8ccd10830a0e5e979099a022fb07019e2ac479e

SHA256
0d9caf1dc4c3317085c4fd81a56df506c99dacb883c341a2250d8ef9beffbdba

SHA512
5083a7b3500841b05c879151cde2dda997cf70fbe0dbec5b218dc5efe37084af976fcb67511c92fff21f6b0b5dafdc01f03b448b731db56e7f1f851017467304

Download Submit
C:\Users\Admin\AppData\Local\Temp\notepad .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
\Users\Admin\AppData\Local\Temp\notepad .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
\Users\Admin\AppData\Local\Temp\notepad .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
\Users\Admin\AppData\Local\Temp\notepad .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
\Users\Admin\AppData\Local\Temp\notepad .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
\Users\Admin\AppData\Local\Temp\notepad .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
\Users\Admin\AppData\Local\Temp\notepad .exe

Filesize
54KB

MD5
0f01571a3e4c71eb4313175aae86488e

SHA1
2ba648afe2cd52edf5f25e304f77d457abf7ac0e

SHA256
8cc51c4c2efc8c6a401aa83a0aeced0925d5d9d2a43192f35561893cdf704022

SHA512
159dfbb7d385bf92f4fc48ca389b89d69f6c2616e90dfa056e725d7da78a3702694a28f9c5cab7b55adc4d4dbd7bfe5d272c8b1c9931e3ac95f6326d74576794

Download Submit
memory/396-81-0x0000000000000000-mapping.dmp

Download
memory/544-79-0x0000000000000000-mapping.dmp

Download
memory/624-84-0x0000000000000000-mapping.dmp

Download
memory/1256-70-0x0000000000000000-mapping.dmp

Download
memory/1272-55-0x0000000000000000-mapping.dmp

Download
memory/1912-66-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1912-64-0x0000000000000000-mapping.dmp

Download
memory/1912-62-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1912-60-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1912-59-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1916-69-0x0000000000000000-mapping.dmp

Download
memory/2028-54-0x0000000076651000-0x0000000076653000-memory.dmp

Filesize
8KB

Download
memory/2028-56-0x0000000074BD0000-0x000000007517B000-memory.dmp

Filesize
5.7MB

Download
memory/2028-63-0x0000000074BD0000-0x000000007517B000-memory.dmp

Filesize
5.7MB

Download
memory/2028-85-0x0000000074BD0000-0x000000007517B000-memory.dmp

Filesize
5.7MB

Download