Analysis

  • max time kernel
    50s
  • max time network
    74s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-03-2024 23:32

Errors

Reason
Machine shutdown

General

  • Target

    Trojan/666.exe

  • Size

    6.8MB

  • MD5

    63c96886aade3b86d982ad249ef7eb50

  • SHA1

    12a56093ebfa3ba038742ab7e9a472727e70a3b5

  • SHA256

    db6bbaa7de79fa26489c511fb59e996db796a491f047539fea8ef42107ff3eb6

  • SHA512

    bcaf4f10292e4b15ab940457f13a917a323a47e03084e4694dab158d4c4f47807080407ceb206945b19a385411b7fb36d80ce39a07e1da7d88e38694b259c06c

  • SSDEEP

    12288:+Rx0AYhMCua0AYhMCuulE0AYhMCud0AYhMCuf:+Rx0n3b0n3PlE0n3C0n3I

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Modifies WinLogon 2 TTPs 1 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"
    1⤵
    • Modifies WinLogon
    • Sets desktop wallpaper using registry
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /f /im explorer.exe
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1352
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic useraccount where name='Admin' set FullName='No System Anymore'
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3732
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic useraccount where name='Admin' rename 'No System Anymore'
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4084
      • C:\Windows\SysWOW64\shutdown.exe
        shutdown /f /r /t 0
        3⤵
          PID:1956
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4184 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:4600
      • C:\Windows\system32\LogonUI.exe
        "LogonUI.exe" /flags:0x4 /state0:0xa3940855 /state1:0x41c64e6d
        1⤵
        • Modifies data under HKEY_USERS
        • Suspicious use of SetWindowsHookEx
        PID:4144

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe

        Filesize

        128KB

        MD5

        1752fc8c651ac03a9c863946ac76366d

        SHA1

        03b4668b7f6b09f55b73be9c67e8d24850eeecaf

        SHA256

        2b0c1632471eb16a8731dd0a6396d98209f8cbb9aab7cca6864fdedde87f71c6

        SHA512

        46f9b269843cd9c636c4511aa7fc9b640bcb675490e15258b6eec6f02c179a3a396da9de32238df6600d3bad3ff5c46da56a35f69b9a0873e0d7272ec33bcc94

      • C:\Users\Admin\AppData\Local\Temp\bsod.exe

        Filesize

        274KB

        MD5

        f1896231e9622dd044601962a9866a77

        SHA1

        36ad39e7d797ae43ee415e90a2dc234e0be3087b

        SHA256

        a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8

        SHA512

        e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901

      • C:\Users\Admin\AppData\Local\Temp\noway.txt

        Filesize

        912B

        MD5

        391403276c6df4a164b0544a3411c6c7

        SHA1

        c4c06a4c7710d1d8140b07abd4b7bcd4187485ab

        SHA256

        524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b

        SHA512

        2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8

      • C:\Users\Admin\AppData\Local\Temp\z666.bat

        Filesize

        691B

        MD5

        ee655674ba8e05d5a4c32de58a6757c1

        SHA1

        f06f54710d5a0b341a9e6d467e1bb1a78f2f9606

        SHA256

        40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef

        SHA512

        26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd

      • memory/4676-0-0x0000000075100000-0x00000000758B0000-memory.dmp

        Filesize

        7.7MB

      • memory/4676-1-0x00000000007A0000-0x0000000000E6A000-memory.dmp

        Filesize

        6.8MB

      • memory/4676-2-0x0000000005E00000-0x00000000063A4000-memory.dmp

        Filesize

        5.6MB

      • memory/4676-3-0x0000000005850000-0x00000000058E2000-memory.dmp

        Filesize

        584KB

      • memory/4676-4-0x0000000005820000-0x0000000005830000-memory.dmp

        Filesize

        64KB

      • memory/4676-5-0x0000000005920000-0x000000000592A000-memory.dmp

        Filesize

        40KB

      • memory/4676-20-0x0000000005820000-0x0000000005830000-memory.dmp

        Filesize

        64KB

      • memory/4676-822-0x0000000075100000-0x00000000758B0000-memory.dmp

        Filesize

        7.7MB