ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1

Reason

Machine shutdown

General

Target

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Size

590KB
MD5

88308074e4db96772825ed3e257c0adb
SHA1

a356c2e2ecfaade0c62b361d89eb058784f78c4d
SHA256

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1
SHA512

dfb45a5204250e0c35ff3775db6f2610d6b182d97258b6253fabe6c614141f2ed75168e61cbd8250f60398e9f894c8d3e713e14f1e2b529bc9d1a87ce8f63717
SSDEEP

12288:J6Wq4aaE6KwyF5L0Y2D1PqLc0WLakcXhjtI2RTDXoLsa0P6p:fthEVaPqLCLvcXh5I2RTMCQ

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

Disables Task Manager via registry modification
evasion

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1672-54-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/1672-57-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral1/memory/1672-59-0x0000000000400000-0x00000000004BA000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ja.lnk	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1672-57-0x0000000000400000-0x00000000004BA000-memory.dmp	autoit_exe
behavioral1/memory/1672-59-0x0000000000400000-0x00000000004BA000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer Protected Mode 1 TTPs 5 IoCs

Modify Registry

T1112

Processes:

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs

Modify Registry

T1112

Processes:

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

pid	process
1672	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
1672	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

description pid process

Token: SeShutdownPrivilege 1672 ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

description	pid	process
Token: SeShutdownPrivilege	1672	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

pid	process
1672	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
1672	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

System policy modification 1 TTPs 8 IoCs

evasion

Modify Registry

T1112

Processes:

ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\DefaultFileTypeRisk = "1807"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\LowRiskFileTypes = ".exe"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations\ModRiskFileTypes = ".doc;.pdf;.xls;.exe"	ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe

C:\Users\Admin\AppData\Local\Temp\ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe
"C:\Users\Admin\AppData\Local\Temp\ef745b3e0b695e3f29eb20e3d1a8524afabdd8eb59457239af76021556c39ca1.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Drops startup file
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1672

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1120

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

5

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1120-58-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/1672-54-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1672-55-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1672-56-0x0000000000300000-0x0000000000310000-memory.dmp

Filesize
64KB

Download
memory/1672-57-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1672-59-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads