096fb9885d983bd9d2190ce312517caa75fcbfd44236fca51d6e23609240086d

General

Target

Loader.exe
Size

27KB
MD5

a765b141758f0ec10521afa80e041f68
SHA1

9417433c49c7ff3a5cba76d46b5e551203e8afbe
SHA256

096fb9885d983bd9d2190ce312517caa75fcbfd44236fca51d6e23609240086d
SHA512

9519a9d63b175392119f5553ff6d9cd76d8d145fc0070e252225a429a6238d89a7e6190548376a85eb162af6d4d0e376740ee05f2244cc760ffe0d045d8d86d8
SSDEEP

384:eLw6lnw3m4Afp1UDMoC2PDdVlMVAQk93vmhm7UMKmIEecKdbXTzm9bVhcaCh6frZ:IwyBPqqVA/vMHTi9bDC

Score

7^/10

ransomware

Malware Config

Signatures

Drops startup file 3 IoCs

Processes:

Loader.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Loader.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Loader.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Loader.exe

Executes dropped EXE 1 IoCs

Processes:

tmp1349.tmp.exe

pid process

3736 tmp1349.tmp.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

Loader.exe

description ioc process

File opened (read-only) \??\D: Loader.exe

pid	process
3736	tmp1349.tmp.exe

description	ioc	process
File opened (read-only)	\??\D:	Loader.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Loader.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\scary.jpg"	Loader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe

Suspicious behavior: LoadsDriver 64 IoCs

Processes:

pid	process
3952
5072
5000
4124
4980
4916
5020
5112
4900
4924
4944
4960
4968
4976
4876
5116
660
600
656
524
4052
4836
764
3100
8
5104
4796
4804
424
436
3320
512
508
3324
1712
1204
1016
1020
872
836
868
792
920
756
1684
1644
1568
1596
1524
2032
1988
1892
1872
1488
1576
1296
1484
1356
2244
1208
2264
2512
2516
3880

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

Loader.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	1008	Loader.exe
Token: 33	1008	Loader.exe
Token: SeIncBasePriorityPrivilege	1008	Loader.exe
Token: 33	1008	Loader.exe
Token: SeIncBasePriorityPrivilege	1008	Loader.exe
Token: 33	1008	Loader.exe
Token: SeIncBasePriorityPrivilege	1008	Loader.exe
Token: 33	1008	Loader.exe
Token: SeIncBasePriorityPrivilege	1008	Loader.exe
Token: 33	3612	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3612	AUDIODG.EXE
Token: 33	1008	Loader.exe
Token: SeIncBasePriorityPrivilege	1008	Loader.exe
Token: 33	1008	Loader.exe
Token: SeIncBasePriorityPrivilege	1008	Loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

tmp1349.tmp.exeLogonUI.exe

pid process

3736 tmp1349.tmp.exe
4328 LogonUI.exe

pid	process
3736	tmp1349.tmp.exe
4328	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

Loader.exe

description	pid	process	target process
PID 1008 wrote to memory of 3736	1008	Loader.exe	tmp1349.tmp.exe
PID 1008 wrote to memory of 3736	1008	Loader.exe	tmp1349.tmp.exe
PID 1008 wrote to memory of 3736	1008	Loader.exe	tmp1349.tmp.exe
PID 1008 wrote to memory of 4152	1008	Loader.exe	Shutdown.exe
PID 1008 wrote to memory of 4152	1008	Loader.exe	Shutdown.exe
PID 1008 wrote to memory of 4152	1008	Loader.exe	Shutdown.exe

C:\Users\Admin\AppData\Local\Temp\Loader.exe
"C:\Users\Admin\AppData\Local\Temp\Loader.exe"
1⤵
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1008

C:\Users\Admin\AppData\Local\Temp\tmp1349.tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp1349.tmp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3736

C:\Windows\SysWOW64\Shutdown.exe
Shutdown -l
2⤵
PID:4152

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad9055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp1349.tmp.exe
Filesize
24KB

MD5
10e89ee9c92c4d0060aee0481c7d3ba6

SHA1
9514b295a97bebbb3321f9a790ef3c4c99fb5881

SHA256
6805d47786d5fdb951ded12d78bbbb113433cfe289f423366d0cc3e51399ce8c

SHA512
3f7c86b2beeae6291a6237c0372bf48b2938c2c416461173e7114830d15abd88e730b7d8f41c8656ce6b94034a9fa33b2d32b0d9f52fc3af970b4a3a4b8a4d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1349.tmp.exe
Filesize
24KB

MD5
10e89ee9c92c4d0060aee0481c7d3ba6

SHA1
9514b295a97bebbb3321f9a790ef3c4c99fb5881

SHA256
6805d47786d5fdb951ded12d78bbbb113433cfe289f423366d0cc3e51399ce8c

SHA512
3f7c86b2beeae6291a6237c0372bf48b2938c2c416461173e7114830d15abd88e730b7d8f41c8656ce6b94034a9fa33b2d32b0d9f52fc3af970b4a3a4b8a4d89

Download Submit
memory/1008-119-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/1008-122-0x0000000000AB0000-0x0000000000AC0000-memory.dmp

Filesize
64KB

Download
memory/3736-131-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download
memory/3736-132-0x0000000002710000-0x0000000002720000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads