db5273410c933a199d6cde35b970ba18de85f4194870fdfa9ccdead249ecae3b

Analysis

max time kernel
151s
max time network
205s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/02/2023, 18:56 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

decrypted_2.exe
Size

479KB
MD5

73d9cfaa50432fbb0133e3abfce5f40c
SHA1

6ff96f23aef03fbf7efdee970304005cfae8f088
SHA256

d73e9d1fc1c5eca7d3e3c236833f6f98ec189d57aadd08bee5806170cdab6c1a
SHA512

46d8901bcd853cbff340cd85a0bc980e782a174aa4c8204f7cd7a577c080442e78fb89ed49837cf7a7574ef85e31c70b4baeab292281ed3fe8e19671344eeb2a
SSDEEP

6144:UTouKrWBEu3/Z2lpGDHU3ykJmnRT/EXsbIh/JW6skkf28J:UToPWBv/cpGrU3y/nNesbIZJW6nSfJ

Score

8^/10

evasion persistence

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1640	netsh.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bf4f23b08f31e19e05b45991905c12da.exe	wlninit.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bf4f23b08f31e19e05b45991905c12da.exe	wlninit.exe

Executes dropped EXE 3 IoCs

pid	Process
1504	Glitch_loader.exe
1740	wlninit.exe
760	Glitcher.exe

Loads dropped DLL 11 IoCs

pid	Process
932	decrypted_2.exe
932	decrypted_2.exe
932	decrypted_2.exe
932	decrypted_2.exe
932	decrypted_2.exe
1504	Glitch_loader.exe
1504	Glitch_loader.exe
932	decrypted_2.exe
932	decrypted_2.exe
932	decrypted_2.exe
932	decrypted_2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\bf4f23b08f31e19e05b45991905c12da = "\"C:\\Users\\Admin\\AppData\\Roaming\\wlninit.exe\" .."	wlninit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\bf4f23b08f31e19e05b45991905c12da = "\"C:\\Users\\Admin\\AppData\\Roaming\\wlninit.exe\" .."	wlninit.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	wlninit.exe
File opened for modification	C:\autorun.inf	wlninit.exe
File created	D:\autorun.inf	wlninit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe
1740	wlninit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1740	wlninit.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	wlninit.exe
Token: 33	1740	wlninit.exe
Token: SeIncBasePriorityPrivilege	1740	wlninit.exe
Token: 33	1740	wlninit.exe
Token: SeIncBasePriorityPrivilege	1740	wlninit.exe
Token: 33	1740	wlninit.exe
Token: SeIncBasePriorityPrivilege	1740	wlninit.exe
Token: 33	1740	wlninit.exe
Token: SeIncBasePriorityPrivilege	1740	wlninit.exe
Token: 33	1740	wlninit.exe
Token: SeIncBasePriorityPrivilege	1740	wlninit.exe
Token: 33	1740	wlninit.exe
Token: SeIncBasePriorityPrivilege	1740	wlninit.exe
Token: 33	1740	wlninit.exe
Token: SeIncBasePriorityPrivilege	1740	wlninit.exe
Token: 33	1740	wlninit.exe
Token: SeIncBasePriorityPrivilege	1740	wlninit.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 1504	932	decrypted_2.exe	28
PID 932 wrote to memory of 1504	932	decrypted_2.exe	28
PID 932 wrote to memory of 1504	932	decrypted_2.exe	28
PID 932 wrote to memory of 1504	932	decrypted_2.exe	28
PID 1504 wrote to memory of 1740	1504	Glitch_loader.exe	29
PID 1504 wrote to memory of 1740	1504	Glitch_loader.exe	29
PID 1504 wrote to memory of 1740	1504	Glitch_loader.exe	29
PID 1504 wrote to memory of 1740	1504	Glitch_loader.exe	29
PID 932 wrote to memory of 760	932	decrypted_2.exe	30
PID 932 wrote to memory of 760	932	decrypted_2.exe	30
PID 932 wrote to memory of 760	932	decrypted_2.exe	30
PID 932 wrote to memory of 760	932	decrypted_2.exe	30
PID 1740 wrote to memory of 1640	1740	wlninit.exe	31
PID 1740 wrote to memory of 1640	1740	wlninit.exe	31
PID 1740 wrote to memory of 1640	1740	wlninit.exe	31
PID 1740 wrote to memory of 1640	1740	wlninit.exe	31

C:\Users\Admin\AppData\Local\Temp\decrypted_2.exe
"C:\Users\Admin\AppData\Local\Temp\decrypted_2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:932
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Users\Admin\AppData\Roaming\wlninit.exe
    "C:\Users\Admin\AppData\Roaming\wlninit.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops autorun.inf file
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1740
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\wlninit.exe" "wlninit.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:1640
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe"
  2⤵
  - Executes dropped EXE
  PID:760

Network

DNS

road-cosmetics.at.ply.gg

wlninit.exe

Remote address:

8.8.8.8:53

Request

road-cosmetics.at.ply.gg

IN A

Response

road-cosmetics.at.ply.gg

IN A

209.25.141.223
DNS

road-cosmetics.at.ply.gg

wlninit.exe

Remote address:

8.8.8.8:53

Request

road-cosmetics.at.ply.gg

IN A

Response

road-cosmetics.at.ply.gg

IN A

209.25.141.223

209.25.141.223:15239

road-cosmetics.at.ply.gg

wlninit.exe

152 B
3
209.25.141.223:15239

road-cosmetics.at.ply.gg

wlninit.exe

152 B
3
209.25.141.223:15239

road-cosmetics.at.ply.gg

wlninit.exe

152 B
3
209.25.141.223:15239

road-cosmetics.at.ply.gg

wlninit.exe

152 B
3
209.25.141.223:15239

road-cosmetics.at.ply.gg

wlninit.exe

52 B
1

8.8.8.8:53

road-cosmetics.at.ply.gg

dns

wlninit.exe

70 B
86 B
1
1

DNS Request

road-cosmetics.at.ply.gg

DNS Response

209.25.141.223
8.8.8.8:53

road-cosmetics.at.ply.gg

dns

wlninit.exe

70 B
86 B
1
1

DNS Request

road-cosmetics.at.ply.gg

DNS Response

209.25.141.223

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe

Filesize
13KB

MD5
e7304abaea601b10c1fd25f73643b8b2

SHA1
d6310b99c1f7819071f1a6e24e06c3178ebc3f0b

SHA256
20b002b1f913fa83a2c05a63881936e839195e9196f15fc92f9b66604fc6fd6c

SHA512
969d59a4533bcd25b440529d92be206700b6e4e6f07f9b283bf1d1ae2961543261dbe49d9649d79568e54d149cc4b41fef26e364929893fae8f53c3ed907ac2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe

Filesize
13KB

MD5
e7304abaea601b10c1fd25f73643b8b2

SHA1
d6310b99c1f7819071f1a6e24e06c3178ebc3f0b

SHA256
20b002b1f913fa83a2c05a63881936e839195e9196f15fc92f9b66604fc6fd6c

SHA512
969d59a4533bcd25b440529d92be206700b6e4e6f07f9b283bf1d1ae2961543261dbe49d9649d79568e54d149cc4b41fef26e364929893fae8f53c3ed907ac2c

Download Submit
C:\Users\Admin\AppData\Roaming\wlninit.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
C:\Users\Admin\AppData\Roaming\wlninit.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Glitch_loader.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe

Filesize
13KB

MD5
e7304abaea601b10c1fd25f73643b8b2

SHA1
d6310b99c1f7819071f1a6e24e06c3178ebc3f0b

SHA256
20b002b1f913fa83a2c05a63881936e839195e9196f15fc92f9b66604fc6fd6c

SHA512
969d59a4533bcd25b440529d92be206700b6e4e6f07f9b283bf1d1ae2961543261dbe49d9649d79568e54d149cc4b41fef26e364929893fae8f53c3ed907ac2c

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe

Filesize
13KB

MD5
e7304abaea601b10c1fd25f73643b8b2

SHA1
d6310b99c1f7819071f1a6e24e06c3178ebc3f0b

SHA256
20b002b1f913fa83a2c05a63881936e839195e9196f15fc92f9b66604fc6fd6c

SHA512
969d59a4533bcd25b440529d92be206700b6e4e6f07f9b283bf1d1ae2961543261dbe49d9649d79568e54d149cc4b41fef26e364929893fae8f53c3ed907ac2c

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe

Filesize
13KB

MD5
e7304abaea601b10c1fd25f73643b8b2

SHA1
d6310b99c1f7819071f1a6e24e06c3178ebc3f0b

SHA256
20b002b1f913fa83a2c05a63881936e839195e9196f15fc92f9b66604fc6fd6c

SHA512
969d59a4533bcd25b440529d92be206700b6e4e6f07f9b283bf1d1ae2961543261dbe49d9649d79568e54d149cc4b41fef26e364929893fae8f53c3ed907ac2c

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Glitcher.exe

Filesize
13KB

MD5
e7304abaea601b10c1fd25f73643b8b2

SHA1
d6310b99c1f7819071f1a6e24e06c3178ebc3f0b

SHA256
20b002b1f913fa83a2c05a63881936e839195e9196f15fc92f9b66604fc6fd6c

SHA512
969d59a4533bcd25b440529d92be206700b6e4e6f07f9b283bf1d1ae2961543261dbe49d9649d79568e54d149cc4b41fef26e364929893fae8f53c3ed907ac2c

Download Submit
\Users\Admin\AppData\Roaming\wlninit.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
\Users\Admin\AppData\Roaming\wlninit.exe

Filesize
52KB

MD5
f3867179dffab4476e51f1ea3e0e730b

SHA1
b4207587e8417a93dbfe5be3a9d885df6f7fcc74

SHA256
1be93b106625cfa0535c5ee37f75baee9703a51bc0efaa8fad08b7f4174e2ab2

SHA512
553cfabb81481d2107f9914b62cc334b52180ea5c15c662069044250d45ba143c6962cefe100716a81f272ee142d92952ea687eadb8a3fa9fe2dfaa720edc71a

Download Submit
memory/760-81-0x00000000010F0000-0x00000000010FA000-memory.dmp

Filesize
40KB

Download
memory/760-82-0x000007FEFC101000-0x000007FEFC103000-memory.dmp

Filesize
8KB

Download
memory/760-86-0x000000001AEB6000-0x000000001AED5000-memory.dmp

Filesize
124KB

Download
memory/932-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1504-72-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/1504-65-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/1504-64-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/1740-80-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download
memory/1740-85-0x0000000074410000-0x00000000749BB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.