75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9

General

Target

75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
Size

97KB
MD5

5383675e7dee2bad06115abaa5a59b4b
SHA1

5350db1e955b919d3e220cc37c48fb58a8e7b6ab
SHA256

75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9
SHA512

e7ac2e7693620321db0a1f7c984f0d874a064978e6ea609bccd52209eab49d593b9ac77bfa174d813f4871e00bb2565a7c471d8fde6ecaeaad782b146a4edbfd
SSDEEP

1536:MZpgvMIvRvwHMWhY7ZXaXJyi5aVwCDOA7yEYkeZ3p4wZJKvcXO:MnbI5vwHMWhYwJyi5wwC35QT4mXO

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\SunJava\\JavaUpdata.exe"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe

description	pid	process	target process
PID 1932 set thread context of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe

pid	process
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe

description	pid	process
Token: SeDebugPrivilege	1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
Token: SeShutdownPrivilege	1004	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.execmd.exe

description	pid	process	target process
PID 1932 wrote to memory of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
PID 1932 wrote to memory of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
PID 1932 wrote to memory of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
PID 1932 wrote to memory of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
PID 1932 wrote to memory of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
PID 1932 wrote to memory of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
PID 1932 wrote to memory of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
PID 1932 wrote to memory of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
PID 1932 wrote to memory of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
PID 1932 wrote to memory of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
PID 1932 wrote to memory of 1004	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
PID 1932 wrote to memory of 1344	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	cmd.exe
PID 1932 wrote to memory of 1344	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	cmd.exe
PID 1932 wrote to memory of 1344	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	cmd.exe
PID 1932 wrote to memory of 1344	1932	75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe	cmd.exe
PID 1344 wrote to memory of 1644	1344	cmd.exe	reg.exe
PID 1344 wrote to memory of 1644	1344	cmd.exe	reg.exe
PID 1344 wrote to memory of 1644	1344	cmd.exe	reg.exe
PID 1344 wrote to memory of 1644	1344	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
"C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1932

C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe
"C:\Users\Admin\AppData\Local\Temp\75531efbfefba9508bf57c600906b84136b2ea08cbaaebfd7ef76c870be6bad9.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"C:\Users\Admin\AppData\Roaming\SunJava\JavaUpdata.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1344

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v shell /t REG_SZ /d explorer.exe,"C:\Users\Admin\AppData\Roaming\SunJava\JavaUpdata.exe"
3⤵
- Modifies WinLogon for persistence
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1004-64-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1004-75-0x0000000000403000-0x0000000000406000-memory.dmp

Filesize
12KB

Download
memory/1004-65-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1004-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1004-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1004-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1004-62-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1004-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1004-74-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1004-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1004-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1004-66-0x0000000000401000-mapping.dmp

Download
memory/1344-70-0x0000000000000000-mapping.dmp

Download
memory/1644-71-0x0000000000000000-mapping.dmp

Download
memory/1932-55-0x0000000074FB0000-0x000000007555B000-memory.dmp

Filesize
5.7MB

Download
memory/1932-72-0x0000000074FB0000-0x000000007555B000-memory.dmp

Filesize
5.7MB

Download
memory/1932-73-0x0000000001F35000-0x0000000001F46000-memory.dmp

Filesize
68KB

Download
memory/1932-56-0x0000000001F35000-0x0000000001F46000-memory.dmp

Filesize
68KB

Download
memory/1932-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads