e33647411f96a47751a54598dffa1e91cdea0a76aa5d7db4e6fb8ed0bc9b6bbb

Reason

Machine shutdown

General

Target

64841ebef17b183b9b3c5b4bdb0d819b.exe
Size

333KB
MD5

64841ebef17b183b9b3c5b4bdb0d819b
SHA1

0e575c10c0f4fe51fe3c0776c92decfd657a73d8
SHA256

e33647411f96a47751a54598dffa1e91cdea0a76aa5d7db4e6fb8ed0bc9b6bbb
SHA512

875ed63224601d00cc3c8f6fdb4c2788e2053de451f2450b9841c96f435676f8b231968db6d04f9cbc4bec40f1937b10a6fe267f48030745c9ee325e8be97868
SSDEEP

6144:L6AaKWS4DJdRz7ufx3ZQw4tXwUZJ1fLOfFmXBt0u8V4v:O5K7uRz7ulEfJJifec4v

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	64841ebef17b183b9b3c5b4bdb0d819b.exe

Executes dropped EXE 1 IoCs

pid	Process
436	FACK.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3320-0-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral2/files/0x00070000000231fb-5.dat	upx
behavioral2/memory/436-14-0x0000000000400000-0x00000000004BA000-memory.dmp	upx
behavioral2/memory/3320-15-0x0000000000400000-0x0000000000437000-memory.dmp	upx
behavioral2/memory/436-16-0x0000000000400000-0x00000000004BA000-memory.dmp	upx

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/436-16-0x0000000000400000-0x00000000004BA000-memory.dmp	autoit_exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FACK.exe	64841ebef17b183b9b3c5b4bdb0d819b.exe
File opened for modification	C:\Program Files (x86)\FACK.exe	64841ebef17b183b9b3c5b4bdb0d819b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "248"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	436	FACK.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe

Suspicious use of SendNotifyMessage 11 IoCs

pid	Process
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe
436	FACK.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4472	LogonUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 436	3320	64841ebef17b183b9b3c5b4bdb0d819b.exe	90
PID 3320 wrote to memory of 436	3320	64841ebef17b183b9b3c5b4bdb0d819b.exe	90
PID 3320 wrote to memory of 436	3320	64841ebef17b183b9b3c5b4bdb0d819b.exe	90

C:\Users\Admin\AppData\Local\Temp\64841ebef17b183b9b3c5b4bdb0d819b.exe
"C:\Users\Admin\AppData\Local\Temp\64841ebef17b183b9b3c5b4bdb0d819b.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files (x86)\FACK.exe
  "C:\Program Files (x86)\FACK.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:436

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b9855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\FACK.exe

Filesize
285KB

MD5
e594b20d3cb5cd34a5f56c407614e61f

SHA1
8788e752dafdefd011c8e31e574152738f08e025

SHA256
e591c27a685e4c55a4bb9982e41ecda9fc44a4f04863eb701bcf5d64bf192b49

SHA512
25d4da74db0be8b658a1c7962cc3ee5c7b5d0ba90ce5bfce0691e693f199fb19232ef4c1c829445a8a7dc48e4feb53a4a5462d3bbf2e5fad4caf5d2b819e0cf3

Download Submit
memory/436-14-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/436-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3320-0-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3320-15-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download

Analysis

Sharing

Errors