8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e

Analysis

max time kernel
102s
max time network
115s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 09:00

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe
Size

871KB
MD5

8e4e5f80d4bec7dc4e3b0055f803d9d1
SHA1

bc9d2c09cd42172b697714225cace127d29b50ea
SHA256

8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e
SHA512

3f5ece6fbc58dec149e0bf5d67895055e7314a59b3478eacf223a0e20f5aaf2730cb22250a571740cb5510b24131c8f18b6600b97809b94550a3f92e3bd5b22d
SSDEEP

24576:OdYJ4Zs7JAaWf66BCaVquMNy2CPtQUL2in:OdY+slAdfLFN2bUKi

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "saliter.exe"	8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "saliter.exe"	8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe

Disables Task Manager via registry modification
evasion
Drops file in Windows directory 1 IoCs

Processes:

8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe

description ioc process

File opened for modification \??\c:\windows\saliter.exe 8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\c:\windows\saliter.exe	8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

shutdown.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	1380	shutdown.exe
Token: SeRemoteShutdownPrivilege	1380	shutdown.exe
Token: 33	672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	672	AUDIODG.EXE
Token: 33	672	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	672	AUDIODG.EXE

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe

description	pid	process	target process
PID 948 wrote to memory of 1380	948	8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe	shutdown.exe
PID 948 wrote to memory of 1380	948	8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe	shutdown.exe
PID 948 wrote to memory of 1380	948	8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe	shutdown.exe
PID 948 wrote to memory of 1380	948	8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe	shutdown.exe

C:\Users\Admin\AppData\Local\Temp\8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe
"C:\Users\Admin\AppData\Local\Temp\8539200ce4a8a629b0460d45a878d8389534c8a93a266641cfd1813792ce109e.exe"
1⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\SysWOW64\shutdown.exe
"C:\Windows\System32\shutdown.exe" -r -t 00
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:672

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1496

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1380-55-0x0000000000000000-mapping.dmp

Download
memory/1680-56-0x000007FEFBB81000-0x000007FEFBB83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads