917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62

Reason

Machine shutdown

General

Target

917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
Size

81KB
MD5

30cf084eeeb56ee7c01a2e214f348d76
SHA1

2b43dfd8c398a4925ea66653d351f84af669d3e3
SHA256

917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62
SHA512

f94dc5a93122999ad35dd3c07bc0db08cfd88ad0e4dc55c7768b3d75e441f290d5a259237cf5401cbc407d50223eb513b03eb3d45f891872b0ff49be2f423f16
SSDEEP

384:PJG14lR/NpKAN+UJfo8vJh/7neuwyv3ZUKcreuDreuwyv3ZUKcreuDz:RFtFe8vJtDeunUreufeunUreuf

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winsys = "C:\\Windows\\system32\\winsock.exe /wininit"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Win32 = "C:\\Windows\\system32\\winkernel32.exe /system"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Welcome = "Salut pti blairo !"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeCaption = "Micromerde Windobe Xnaze"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LegalNoticeText = "Vous utilisez Super Winmerde"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\LogonPrompt = "Entre ton passss !"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\winsock.exe	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
File opened for modification	C:\Windows\SysWOW64\winsock.exe	attrib.exe
File created	C:\Windows\SysWOW64\winkernel32.exe	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
File opened for modification	C:\Windows\SysWOW64\winkernel32.exe	attrib.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "Vive Les Marmottes qui chantent !"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Internet Explorer\Main	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.webfmdr.com/B/"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2024	shutdown.exe
Token: SeRemoteShutdownPrivilege	2024	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
736	LogonUI.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4808	4572	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe	80
PID 4572 wrote to memory of 4808	4572	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe	80
PID 4572 wrote to memory of 4808	4572	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe	80
PID 4808 wrote to memory of 4500	4808	cmd.exe	82
PID 4808 wrote to memory of 4500	4808	cmd.exe	82
PID 4808 wrote to memory of 4500	4808	cmd.exe	82
PID 4572 wrote to memory of 3388	4572	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe	83
PID 4572 wrote to memory of 3388	4572	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe	83
PID 4572 wrote to memory of 3388	4572	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe	83
PID 3388 wrote to memory of 4952	3388	cmd.exe	85
PID 3388 wrote to memory of 4952	3388	cmd.exe	85
PID 3388 wrote to memory of 4952	3388	cmd.exe	85
PID 4572 wrote to memory of 4196	4572	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe	86
PID 4572 wrote to memory of 4196	4572	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe	86
PID 4572 wrote to memory of 4196	4572	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe	86
PID 4196 wrote to memory of 2024	4196	cmd.exe	88
PID 4196 wrote to memory of 2024	4196	cmd.exe	88
PID 4196 wrote to memory of 2024	4196	cmd.exe	88

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoColorChoice = "1"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoSizeChoice = "1"	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
4500	attrib.exe
4952	attrib.exe

C:\Users\Admin\AppData\Local\Temp\917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe
"C:\Users\Admin\AppData\Local\Temp\917fa5baf49e22e84efaded9489bae51466b4be3823118dadd5f3d6835b6ac62.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Windows\system32\winsock.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4808
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Windows\system32\winsock.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:4500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Windows\system32\winkernel32.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3388
- - C:\Windows\SysWOW64\attrib.exe
    attrib +h +s "C:\Windows\system32\winkernel32.exe"
    3⤵
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:4952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -r
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2024

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa399b055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

3

T1158

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\winkernel32.exe

Filesize
82KB

MD5
2d5f13ab450419daf51ea24c166a4643

SHA1
660314edf71170b4a356992cc80f517e7873baf3

SHA256
9d32a4555e55e433200cd6a17dafa745731e3b789a4d4252d67b595891267d39

SHA512
c7f2cba5763cca86bbc26104678c6f5f9af1435dca1783d3526f4b1d2c036ed9b7b7d09f22af0aeaa13cfda470a75b49781c556d6d39814ebec0ad1b3f00f503

Download Submit
C:\Windows\SysWOW64\winsock.exe

Filesize
104KB

MD5
7f29eebbc3d0a02292dccfff0d58adb9

SHA1
5babae24a81020b742d2b7755cc4bd86e92b8dff

SHA256
f3964c3743e56479e18661e1f09eedcb1200e65978322fb5c26e25c4ecc7305f

SHA512
c0670a2eb2f5eb272dbd2b715ff1f4d47f9fcf99f54f77417e8829cb1430a802b4f45b96a7239660f338249c9fff3a72228476d544dfe798d106a97df9d65734

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads