1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

General

Target

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
Size

280KB
MD5

51df0e1acb613484af2349e71637f850
SHA1

ed841521785d4376fe425619b8fc15009b4f1c8f
SHA256

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf
SHA512

8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19
SSDEEP

3072:XD80DhgAPXSOYjEC8nxEp4l79pEvkMDGQA40diM:XDzhnPCOS8n+s7epiQAN

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

winlogon.exewinlogon.exewinlogon.exewinlogon.exe

pid process

4856 winlogon.exe
2136 winlogon.exe
4440 winlogon.exe
1392 winlogon.exe

pid	process
4856	winlogon.exe
2136	winlogon.exe
4440	winlogon.exe
1392	winlogon.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1932-134-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/2800-136-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral2/memory/1932-137-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/1932-138-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral2/memory/1932-141-0x0000000000400000-0x000000000041C000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/1932-145-0x0000000000400000-0x000000000041C000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
behavioral2/memory/4856-150-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral2/memory/2136-156-0x0000000000400000-0x000000000041C000-memory.dmp	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx
C:\Users\Admin\E696D64614\winlogon.exe	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 2800 set thread context of 1932	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 4856 set thread context of 2136	4856	winlogon.exe	winlogon.exe
PID 2136 set thread context of 4440	2136	winlogon.exe	winlogon.exe
PID 2136 set thread context of 1392	2136	winlogon.exe	winlogon.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4076 1392 WerFault.exe winlogon.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exewinlogon.exe

pid process

1932 1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
2136 winlogon.exe

pid	pid_target	process	target process
4076	1392	WerFault.exe	winlogon.exe

pid	process
1932	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
2136	winlogon.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exewinlogon.exewinlogon.exe

description	pid	process	target process
PID 2800 wrote to memory of 1980	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	svchost.exe
PID 2800 wrote to memory of 1980	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	svchost.exe
PID 2800 wrote to memory of 1980	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	svchost.exe
PID 2800 wrote to memory of 1932	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 2800 wrote to memory of 1932	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 2800 wrote to memory of 1932	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 2800 wrote to memory of 1932	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 2800 wrote to memory of 1932	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 2800 wrote to memory of 1932	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 2800 wrote to memory of 1932	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 2800 wrote to memory of 1932	2800	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
PID 1932 wrote to memory of 4856	1932	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	winlogon.exe
PID 1932 wrote to memory of 4856	1932	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	winlogon.exe
PID 1932 wrote to memory of 4856	1932	1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe	winlogon.exe
PID 4856 wrote to memory of 4304	4856	winlogon.exe	svchost.exe
PID 4856 wrote to memory of 4304	4856	winlogon.exe	svchost.exe
PID 4856 wrote to memory of 4304	4856	winlogon.exe	svchost.exe
PID 4856 wrote to memory of 2136	4856	winlogon.exe	winlogon.exe
PID 4856 wrote to memory of 2136	4856	winlogon.exe	winlogon.exe
PID 4856 wrote to memory of 2136	4856	winlogon.exe	winlogon.exe
PID 4856 wrote to memory of 2136	4856	winlogon.exe	winlogon.exe
PID 4856 wrote to memory of 2136	4856	winlogon.exe	winlogon.exe
PID 4856 wrote to memory of 2136	4856	winlogon.exe	winlogon.exe
PID 4856 wrote to memory of 2136	4856	winlogon.exe	winlogon.exe
PID 4856 wrote to memory of 2136	4856	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 4440	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 4440	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 4440	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 4440	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 4440	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 4440	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 4440	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 4440	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 1392	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 1392	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 1392	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 1392	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 1392	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 1392	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 1392	2136	winlogon.exe	winlogon.exe
PID 2136 wrote to memory of 1392	2136	winlogon.exe	winlogon.exe

C:\Users\Admin\AppData\Local\Temp\1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
"C:\Users\Admin\AppData\Local\Temp\1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2800

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
2⤵
PID:1980

C:\Users\Admin\AppData\Local\Temp\1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf.exe
2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4856

C:\Windows\SysWOW64\svchost.exe
C:\Windows\system32\\svchost.exe
4⤵
PID:4304

C:\Users\Admin\E696D64614\winlogon.exe
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Executes dropped EXE
PID:4440

C:\Users\Admin\E696D64614\winlogon.exe
"C:\Users\Admin\E696D64614\winlogon.exe"
5⤵
- Executes dropped EXE
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 12
6⤵
- Program crash
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 4440 -ip 4440
1⤵
PID:2080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1392 -ip 1392
1⤵
PID:4224

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\E696D64614\winlogon.exe
Filesize
280KB

MD5
51df0e1acb613484af2349e71637f850

SHA1
ed841521785d4376fe425619b8fc15009b4f1c8f

SHA256
1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

SHA512
8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
280KB

MD5
51df0e1acb613484af2349e71637f850

SHA1
ed841521785d4376fe425619b8fc15009b4f1c8f

SHA256
1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

SHA512
8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
280KB

MD5
51df0e1acb613484af2349e71637f850

SHA1
ed841521785d4376fe425619b8fc15009b4f1c8f

SHA256
1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

SHA512
8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
280KB

MD5
51df0e1acb613484af2349e71637f850

SHA1
ed841521785d4376fe425619b8fc15009b4f1c8f

SHA256
1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

SHA512
8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19

Download Submit
C:\Users\Admin\E696D64614\winlogon.exe
Filesize
280KB

MD5
51df0e1acb613484af2349e71637f850

SHA1
ed841521785d4376fe425619b8fc15009b4f1c8f

SHA256
1fd8ba80b5821f1a767b0ba37bc36d05ce7923bbe224485611ff4172e96a5caf

SHA512
8e5b6407d6182c220a2fab6e7d5045e46825973e3e55d48e617cbaa7c9bc60a94c2852b9582a5c8ccb42f948d56f57cbcd9545c767efa008221267f19af06f19

Download Submit
memory/1392-160-0x0000000000000000-mapping.dmp

Download
memory/1932-145-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1932-137-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1932-141-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1932-138-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1932-133-0x0000000000000000-mapping.dmp

Download
memory/1932-134-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1980-132-0x0000000000000000-mapping.dmp

Download
memory/2136-147-0x0000000000000000-mapping.dmp

Download
memory/2136-156-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2800-136-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4304-146-0x0000000000000000-mapping.dmp

Download
memory/4440-157-0x0000000000000000-mapping.dmp

Download
memory/4856-150-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/4856-142-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads