Analysis
-
max time kernel
62s -
max time network
67s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
31-03-2023 22:16
Static task
static1
Behavioral task
behavioral1
Sample
Endermanch@MEMZ.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Endermanch@MEMZ.exe
Resource
win10v2004-20230221-en
General
-
Target
Endermanch@MEMZ.exe
-
Size
14KB
-
MD5
19dbec50735b5f2a72d4199c4e184960
-
SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822
-
SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
-
SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
-
SSDEEP
192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Endermanch@MEMZ.exeEndermanch@MEMZ.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation Endermanch@MEMZ.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation Endermanch@MEMZ.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
Endermanch@MEMZ.exedescription ioc process File opened for modification \??\PhysicalDrive0 Endermanch@MEMZ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "241" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Endermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exepid process 4692 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 556 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 556 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 556 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 556 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 556 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 556 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 556 Endermanch@MEMZ.exe 556 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 1716 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 556 Endermanch@MEMZ.exe 556 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
mmc.exedescription pid process Token: 33 2824 mmc.exe Token: SeIncBasePriorityPrivilege 2824 mmc.exe Token: 33 2824 mmc.exe Token: SeIncBasePriorityPrivilege 2824 mmc.exe Token: 33 2824 mmc.exe Token: SeIncBasePriorityPrivilege 2824 mmc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
mmc.exepid process 2824 mmc.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
Endermanch@MEMZ.exemmc.exemmc.exeLogonUI.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exeEndermanch@MEMZ.exepid process 4624 Endermanch@MEMZ.exe 544 mmc.exe 2824 mmc.exe 2824 mmc.exe 836 LogonUI.exe 1716 Endermanch@MEMZ.exe 5104 Endermanch@MEMZ.exe 556 Endermanch@MEMZ.exe 3960 Endermanch@MEMZ.exe 4692 Endermanch@MEMZ.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
Endermanch@MEMZ.exeEndermanch@MEMZ.exemmc.exedescription pid process target process PID 4924 wrote to memory of 4692 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 4692 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 4692 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 5104 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 5104 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 5104 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 1716 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 1716 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 1716 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 3960 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 3960 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 3960 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 556 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 556 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 556 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 4624 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 4624 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4924 wrote to memory of 4624 4924 Endermanch@MEMZ.exe Endermanch@MEMZ.exe PID 4624 wrote to memory of 2008 4624 Endermanch@MEMZ.exe notepad.exe PID 4624 wrote to memory of 2008 4624 Endermanch@MEMZ.exe notepad.exe PID 4624 wrote to memory of 2008 4624 Endermanch@MEMZ.exe notepad.exe PID 4624 wrote to memory of 544 4624 Endermanch@MEMZ.exe mmc.exe PID 4624 wrote to memory of 544 4624 Endermanch@MEMZ.exe mmc.exe PID 4624 wrote to memory of 544 4624 Endermanch@MEMZ.exe mmc.exe PID 544 wrote to memory of 2824 544 mmc.exe mmc.exe PID 544 wrote to memory of 2824 544 mmc.exe mmc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe" /watchdog2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe"C:\Users\Admin\AppData\Local\Temp\Endermanch@MEMZ.exe" /main2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt3⤵
-
C:\Windows\SysWOW64\mmc.exe"C:\Windows\System32\mmc.exe"3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39f5855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\note.txtFilesize
218B
MD5afa6955439b8d516721231029fb9ca1b
SHA1087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA2568e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
SHA5125da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf