f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3

General

Target

f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe
Size

1.4MB
MD5

12b07070fba39278fc68fe477300f7ea
SHA1

5926bdd2e3ad13e1f14372e17268652f3cd0b301
SHA256

f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3
SHA512

2a901218bf7ef4f92866859df55f667ee81e059819a0e81131f1d003a20a4d73b7dafc5dcd299c3480e7d080fd04995fa78e2dd9ac1bd61230f163ad4cf8b4f8
SSDEEP

12288:HD+UoyWevH5fVoIvUIiZIBTbnMoosJ0PE2F9n2RED1HWVLnLBp:HKUoGf5fVlDR1jMLDx2SR2VL1p

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\FolderName\\csrss.exe"	reg.exe

Loads dropped DLL 1 IoCs

Processes:

f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe

pid process

1664 f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe

pid	process
1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe
1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe
1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe
1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe
1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe

description pid process

Token: SeDebugPrivilege 1664 f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe

description	pid	process
Token: SeDebugPrivilege	1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.execmd.exewscript.execmd.exe

description	pid	process	target process
PID 1664 wrote to memory of 588	1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe	cmd.exe
PID 1664 wrote to memory of 588	1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe	cmd.exe
PID 1664 wrote to memory of 588	1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe	cmd.exe
PID 1664 wrote to memory of 588	1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe	cmd.exe
PID 1664 wrote to memory of 844	1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe	svhost.exe
PID 1664 wrote to memory of 844	1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe	svhost.exe
PID 1664 wrote to memory of 844	1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe	svhost.exe
PID 1664 wrote to memory of 844	1664	f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe	svhost.exe
PID 588 wrote to memory of 1160	588	cmd.exe	wscript.exe
PID 588 wrote to memory of 1160	588	cmd.exe	wscript.exe
PID 588 wrote to memory of 1160	588	cmd.exe	wscript.exe
PID 588 wrote to memory of 1160	588	cmd.exe	wscript.exe
PID 1160 wrote to memory of 1976	1160	wscript.exe	cmd.exe
PID 1160 wrote to memory of 1976	1160	wscript.exe	cmd.exe
PID 1160 wrote to memory of 1976	1160	wscript.exe	cmd.exe
PID 1160 wrote to memory of 1976	1160	wscript.exe	cmd.exe
PID 1976 wrote to memory of 1780	1976	cmd.exe	reg.exe
PID 1976 wrote to memory of 1780	1976	cmd.exe	reg.exe
PID 1976 wrote to memory of 1780	1976	cmd.exe	reg.exe
PID 1976 wrote to memory of 1780	1976	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe
"C:\Users\Admin\AppData\Local\Temp\f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Roaming\FolderName\mata.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs" "C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat"
3⤵
- Suspicious use of WriteProcessMemory
PID:1160

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat" "
4⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Shell /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderName\csrss.exe" /f
5⤵
- Modifies WinLogon for persistence
PID:1780

C:\Users\Admin\AppData\Roaming\svhost.exe
C:\Users\Admin\AppData\Roaming\svhost.exe
2⤵
PID:844

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1

T1004

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\FolderName\csrss.exe
Filesize
1.4MB

MD5
12b07070fba39278fc68fe477300f7ea

SHA1
5926bdd2e3ad13e1f14372e17268652f3cd0b301

SHA256
f1b994f93c8867633ba81a83ed1936cd0ed2a9843395858853a84ac55f06b0f3

SHA512
2a901218bf7ef4f92866859df55f667ee81e059819a0e81131f1d003a20a4d73b7dafc5dcd299c3480e7d080fd04995fa78e2dd9ac1bd61230f163ad4cf8b4f8

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\invs.vbs
Filesize
78B

MD5
c578d9653b22800c3eb6b6a51219bbb8

SHA1
a97aa251901bbe179a48dbc7a0c1872e163b1f2d

SHA256
20a98a7e6e137bb1b9bd5ef6911a479cb8eac925b80d6db4e70b19f62a40cce2

SHA512
3ae6dc8f02d1a78e1235a0782b632972da5a74ab32287cc41aa672d4fa4a9d34bb5fc50eba07b6915f2e61c402927cd5f6feeb7f7602afa2f64e91efb3b7fc4d

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\mata.bat
Filesize
76B

MD5
5e57f6f4e3242ad9719ed5e65346e83e

SHA1
72346d0208c5edeb69f41ddb4374d56d87221dad

SHA256
4ffb3e764dfbc48145231f19e2217f666bc88a44c6f29adec6a5728223048d0c

SHA512
7dcd8a5a95965b94bf26ec02ab68b8f854f399d41fb713e4387f6fddb9914c465ccf909f92ee6704e9c0397a77f11f2ca803d68184aa414651988d95824a209f

Download Submit
C:\Users\Admin\AppData\Roaming\FolderName\mata2.bat
Filesize
272B

MD5
d2ae9f19943cffe5917930eeabe5a385

SHA1
1b45ac0ca4627a0cc755b8931d1cf4a7f2cad43e

SHA256
d30121c2a84d7bea635611dcc2794a950ea18f42c7d381fe46eb24558dfe8c56

SHA512
d2b077e56b91456d4446f9611605530192948052dc037efc446a3a13d41a855fb93fb0deb3363183d868eac2f55ff3b7a3cd95db329ed74badade7cb51498c26

Download Submit
\Users\Admin\AppData\Roaming\svhost.exe
Filesize
52KB

MD5
278edbd499374bf73621f8c1f969d894

SHA1
a81170af14747781c5f5f51bb1215893136f0bc0

SHA256
c6999b9f79932c3b4f1c461a69d9dc8dc301d6a155abc33efe1b6e9e4a038391

SHA512
93b0b5c3324bd2df83310f96d34c9176c94d2d676766599c1af33c98ba1efe63187056671f7c6f80c956e5bd0a725f108804021ad93326286bb9c3a96f6550b9

Download Submit
memory/588-56-0x0000000000000000-mapping.dmp

Download
memory/1160-59-0x0000000000000000-mapping.dmp

Download
memory/1664-54-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1664-55-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/1664-66-0x0000000074610000-0x0000000074BBB000-memory.dmp

Filesize
5.7MB

Download
memory/1780-64-0x0000000000000000-mapping.dmp

Download
memory/1976-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads