1c924e5c3639fd9af8263c985dad9d7fb41b4eb23133563362cff92f3b410f07

Analysis

max time kernel
27s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2023, 14:46

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0FF1C3 2021 - by Diekrolo/M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M/OInstall.exe
Size

10.9MB
MD5

ebc58647462ad9c76395ef451064d115
SHA1

14e470812f13b278b2694a4cec5737a39784e9dd
SHA256

414155bf11893ec64ba0f4ffb7de92885090845a0761cf8f6743462aa5991d5e
SHA512

8a9ef093d151957ae3c4c8e572fcdbd2198398c95ff8186d532853856c12c8f9ae7408c4f24518c5903faa517ea4e1d5779e797c5a4d850073fbee3ab801e8cc
SSDEEP

196608:2ZnMGjZsDEsCaYsGEHy61bgUhufRswPU2/V8Gd83/PALDP0PiaQxhwf+9zYul28S:WnjZhsCOU6ZgfPPPuGdnv0fzfoDYtB

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4632-133-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral2/memory/4632-135-0x0000000000400000-0x000000000199D000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "247"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4964	WMIC.exe
Token: SeSecurityPrivilege	4964	WMIC.exe
Token: SeTakeOwnershipPrivilege	4964	WMIC.exe
Token: SeLoadDriverPrivilege	4964	WMIC.exe
Token: SeSystemProfilePrivilege	4964	WMIC.exe
Token: SeSystemtimePrivilege	4964	WMIC.exe
Token: SeProfSingleProcessPrivilege	4964	WMIC.exe
Token: SeIncBasePriorityPrivilege	4964	WMIC.exe
Token: SeCreatePagefilePrivilege	4964	WMIC.exe
Token: SeBackupPrivilege	4964	WMIC.exe
Token: SeRestorePrivilege	4964	WMIC.exe
Token: SeShutdownPrivilege	4964	WMIC.exe
Token: SeDebugPrivilege	4964	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4964	WMIC.exe
Token: SeRemoteShutdownPrivilege	4964	WMIC.exe
Token: SeUndockPrivilege	4964	WMIC.exe
Token: SeManageVolumePrivilege	4964	WMIC.exe
Token: 33	4964	WMIC.exe
Token: 34	4964	WMIC.exe
Token: 35	4964	WMIC.exe
Token: 36	4964	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4964	WMIC.exe
Token: SeSecurityPrivilege	4964	WMIC.exe
Token: SeTakeOwnershipPrivilege	4964	WMIC.exe
Token: SeLoadDriverPrivilege	4964	WMIC.exe
Token: SeSystemProfilePrivilege	4964	WMIC.exe
Token: SeSystemtimePrivilege	4964	WMIC.exe
Token: SeProfSingleProcessPrivilege	4964	WMIC.exe
Token: SeIncBasePriorityPrivilege	4964	WMIC.exe
Token: SeCreatePagefilePrivilege	4964	WMIC.exe
Token: SeBackupPrivilege	4964	WMIC.exe
Token: SeRestorePrivilege	4964	WMIC.exe
Token: SeShutdownPrivilege	4964	WMIC.exe
Token: SeDebugPrivilege	4964	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4964	WMIC.exe
Token: SeRemoteShutdownPrivilege	4964	WMIC.exe
Token: SeUndockPrivilege	4964	WMIC.exe
Token: SeManageVolumePrivilege	4964	WMIC.exe
Token: 33	4964	WMIC.exe
Token: 34	4964	WMIC.exe
Token: 35	4964	WMIC.exe
Token: 36	4964	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3792	WMIC.exe
Token: SeSecurityPrivilege	3792	WMIC.exe
Token: SeTakeOwnershipPrivilege	3792	WMIC.exe
Token: SeLoadDriverPrivilege	3792	WMIC.exe
Token: SeSystemProfilePrivilege	3792	WMIC.exe
Token: SeSystemtimePrivilege	3792	WMIC.exe
Token: SeProfSingleProcessPrivilege	3792	WMIC.exe
Token: SeIncBasePriorityPrivilege	3792	WMIC.exe
Token: SeCreatePagefilePrivilege	3792	WMIC.exe
Token: SeBackupPrivilege	3792	WMIC.exe
Token: SeRestorePrivilege	3792	WMIC.exe
Token: SeShutdownPrivilege	3792	WMIC.exe
Token: SeDebugPrivilege	3792	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3792	WMIC.exe
Token: SeRemoteShutdownPrivilege	3792	WMIC.exe
Token: SeUndockPrivilege	3792	WMIC.exe
Token: SeManageVolumePrivilege	3792	WMIC.exe
Token: 33	3792	WMIC.exe
Token: 34	3792	WMIC.exe
Token: 35	3792	WMIC.exe
Token: 36	3792	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3792	WMIC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3744	LogonUI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 316	4632	OInstall.exe	83
PID 4632 wrote to memory of 316	4632	OInstall.exe	83
PID 316 wrote to memory of 4964	316	cmd.exe	85
PID 316 wrote to memory of 4964	316	cmd.exe	85
PID 4632 wrote to memory of 4952	4632	OInstall.exe	87
PID 4632 wrote to memory of 4952	4632	OInstall.exe	87
PID 4952 wrote to memory of 3792	4952	cmd.exe	89
PID 4952 wrote to memory of 3792	4952	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe
"C:\Users\Admin\AppData\Local\Temp\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\OInstall.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4964
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\0FF1C3 2021 - by Diekrolo\M1CR0S0F7 0FF1C3 2021 (LICENCIA PERPETUA) -S.M\files"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3792

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39a2855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4632-133-0x0000000000400000-0x000000000199D000-memory.dmp

Filesize
21.6MB

Download
memory/4632-135-0x0000000000400000-0x000000000199D000-memory.dmp

Filesize
21.6MB

Download