37f99309053d3b0adce6bac240249f0390c6370a7b1f6d2099b7e838f6df91b7

General

Target

4cb1f84904af2dc04d8608ad00f8ca1e.exe
Size

682KB
MD5

4cb1f84904af2dc04d8608ad00f8ca1e
SHA1

deffa46803104931299d35c93cff59f8aa8d57c2
SHA256

37f99309053d3b0adce6bac240249f0390c6370a7b1f6d2099b7e838f6df91b7
SHA512

e8c2cf790c4ea089b4ab907607e22c8dfd456b6f9ec8e90ec2df7be0f54d630449f3704b86e3a1e70f16fb56b72bb55ad55cfd7e6c3ba31bfd3015b412ecea36
SSDEEP

12288:VQZNFmu3KRFD4R6pME87tEJ8hWgZD3nOBi:VQzFmu3e4R6pME87tEJ8hWEO

Score

10^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\Userinit.exe, C:\\Windows\\death.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\Userinit.exe, C:\\Windows\\death.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\Userinit.exe, C:\\Windows\\death.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4cb1f84904af2dc04d8608ad00f8ca1e.exe

Blocks application from running via registry modification 3 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "p2settings.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	4cb1f84904af2dc04d8608ad00f8ca1e.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\death.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Windows\\death.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processhacker.exe	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\death.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell_ise.exe	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\processhacker.exe\Debugger = "C:\\Windows\\death.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell_ise.exe\Debugger = "C:\\Windows\\death.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\death.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4cb1f84904af2dc04d8608ad00f8ca1e.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4cb1f84904af2dc04d8608ad00f8ca1e.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	4cb1f84904af2dc04d8608ad00f8ca1e.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4cb1f84904af2dc04d8608ad00f8ca1e.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "0"	4cb1f84904af2dc04d8608ad00f8ca1e.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\666.bmp"	4cb1f84904af2dc04d8608ad00f8ca1e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\666.bmp	4cb1f84904af2dc04d8608ad00f8ca1e.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\Desktop	4cb1f84904af2dc04d8608ad00f8ca1e.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4cb1f84904af2dc04d8608ad00f8ca1e.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4cb1f84904af2dc04d8608ad00f8ca1e.exe"	4cb1f84904af2dc04d8608ad00f8ca1e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4992	4cb1f84904af2dc04d8608ad00f8ca1e.exe

System policy modification 1 TTPs 13 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\AutoAdminLogon = "0"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallPaper = "1"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "~\x7f{â€¡â€°Ë†"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "~\x7f{â€¡â€°Ë†"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon = "0"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	4cb1f84904af2dc04d8608ad00f8ca1e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	4cb1f84904af2dc04d8608ad00f8ca1e.exe

C:\Users\Admin\AppData\Local\Temp\4cb1f84904af2dc04d8608ad00f8ca1e.exe
"C:\Users\Admin\AppData\Local\Temp\4cb1f84904af2dc04d8608ad00f8ca1e.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Blocks application from running via registry modification
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4992