6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

240316-sq9desff3410

16/03/2024, 15:16

240316-sns9esdf2110

Analysis

max time kernel
4s
max time network
10s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Trojan/666.exe
Size 6.8MB
Sample240316-sns9esdf21
SHA256 db6bbaa7de79fa26489c511fb59e996db796a491f047539fea8ef42107ff3eb6
MD5 63c96886aade3b86d982ad249ef7eb50
SHA1 12a56093ebfa3ba038742ab7e9a472727e70a3b5
SHA512 bcaf4f10292e4b15ab940457f13a917a323a47e03084e4694dab158d4c4f47807080407ceb206945b19a385411b7fb36d80ce39a07e1da7d88e38694b259c06c
SSDEEP 12288:+Rx0AYhMCua0AYhMCuulE0AYhMCud0AYhMCuf:+Rx0n3b0n3PlE0n3C0n3I
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion persistence ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	666.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png"	666.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2584	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico"	666.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2584	taskkill.exe
Token: SeIncreaseQuotaPrivilege	2656	WMIC.exe
Token: SeSecurityPrivilege	2656	WMIC.exe
Token: SeTakeOwnershipPrivilege	2656	WMIC.exe
Token: SeLoadDriverPrivilege	2656	WMIC.exe
Token: SeSystemProfilePrivilege	2656	WMIC.exe
Token: SeSystemtimePrivilege	2656	WMIC.exe
Token: SeProfSingleProcessPrivilege	2656	WMIC.exe
Token: SeIncBasePriorityPrivilege	2656	WMIC.exe
Token: SeCreatePagefilePrivilege	2656	WMIC.exe
Token: SeBackupPrivilege	2656	WMIC.exe
Token: SeRestorePrivilege	2656	WMIC.exe
Token: SeShutdownPrivilege	2656	WMIC.exe
Token: SeDebugPrivilege	2656	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2656	WMIC.exe
Token: SeRemoteShutdownPrivilege	2656	WMIC.exe
Token: SeUndockPrivilege	2656	WMIC.exe
Token: SeManageVolumePrivilege	2656	WMIC.exe
Token: 33	2656	WMIC.exe
Token: 34	2656	WMIC.exe
Token: 35	2656	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2656	WMIC.exe
Token: SeSecurityPrivilege	2656	WMIC.exe
Token: SeTakeOwnershipPrivilege	2656	WMIC.exe
Token: SeLoadDriverPrivilege	2656	WMIC.exe
Token: SeSystemProfilePrivilege	2656	WMIC.exe
Token: SeSystemtimePrivilege	2656	WMIC.exe
Token: SeProfSingleProcessPrivilege	2656	WMIC.exe
Token: SeIncBasePriorityPrivilege	2656	WMIC.exe
Token: SeCreatePagefilePrivilege	2656	WMIC.exe
Token: SeBackupPrivilege	2656	WMIC.exe
Token: SeRestorePrivilege	2656	WMIC.exe
Token: SeShutdownPrivilege	2656	WMIC.exe
Token: SeDebugPrivilege	2656	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2656	WMIC.exe
Token: SeRemoteShutdownPrivilege	2656	WMIC.exe
Token: SeUndockPrivilege	2656	WMIC.exe
Token: SeManageVolumePrivilege	2656	WMIC.exe
Token: 33	2656	WMIC.exe
Token: 34	2656	WMIC.exe
Token: 35	2656	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2516	WMIC.exe
Token: SeSecurityPrivilege	2516	WMIC.exe
Token: SeTakeOwnershipPrivilege	2516	WMIC.exe
Token: SeLoadDriverPrivilege	2516	WMIC.exe
Token: SeSystemProfilePrivilege	2516	WMIC.exe
Token: SeSystemtimePrivilege	2516	WMIC.exe
Token: SeProfSingleProcessPrivilege	2516	WMIC.exe
Token: SeIncBasePriorityPrivilege	2516	WMIC.exe
Token: SeCreatePagefilePrivilege	2516	WMIC.exe
Token: SeBackupPrivilege	2516	WMIC.exe
Token: SeRestorePrivilege	2516	WMIC.exe
Token: SeShutdownPrivilege	2516	WMIC.exe
Token: SeDebugPrivilege	2516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2516	WMIC.exe
Token: SeRemoteShutdownPrivilege	2516	WMIC.exe
Token: SeUndockPrivilege	2516	WMIC.exe
Token: SeManageVolumePrivilege	2516	WMIC.exe
Token: 33	2516	WMIC.exe
Token: 34	2516	WMIC.exe
Token: 35	2516	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2516	WMIC.exe
Token: SeSecurityPrivilege	2516	WMIC.exe
Token: SeTakeOwnershipPrivilege	2516	WMIC.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2284	666.exe
2284	666.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2524	2284	666.exe	28
PID 2284 wrote to memory of 2524	2284	666.exe	28
PID 2284 wrote to memory of 2524	2284	666.exe	28
PID 2284 wrote to memory of 2524	2284	666.exe	28
PID 2524 wrote to memory of 2584	2524	cmd.exe	30
PID 2524 wrote to memory of 2584	2524	cmd.exe	30
PID 2524 wrote to memory of 2584	2524	cmd.exe	30
PID 2524 wrote to memory of 2584	2524	cmd.exe	30
PID 2524 wrote to memory of 2656	2524	cmd.exe	32
PID 2524 wrote to memory of 2656	2524	cmd.exe	32
PID 2524 wrote to memory of 2656	2524	cmd.exe	32
PID 2524 wrote to memory of 2656	2524	cmd.exe	32
PID 2524 wrote to memory of 2516	2524	cmd.exe	33
PID 2524 wrote to memory of 2516	2524	cmd.exe	33
PID 2524 wrote to memory of 2516	2524	cmd.exe	33
PID 2524 wrote to memory of 2516	2524	cmd.exe	33
PID 2524 wrote to memory of 1584	2524	cmd.exe	34
PID 2524 wrote to memory of 1584	2524	cmd.exe	34
PID 2524 wrote to memory of 1584	2524	cmd.exe	34
PID 2524 wrote to memory of 1584	2524	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"
1⤵
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2584
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='No System Anymore'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2656
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'No System Anymore'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2516
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /f /r /t 0
    3⤵
    PID:1584

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2264

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

NoSystemAnymore.exe

Path C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe
Size 273KB
SHA256 b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709
MD5 ef4e8ea4440efc48d5cd1a05a3a6f2a8
SHA1 74b5a40d4d9cb94ac7ed93b1cf9045539e50f068
SHA512 f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4
SSDEEP 1536:nikbx7E9d+ZEekYn/A5PjzAEeyWTcZOC+0VA+BwnMmYcLvA9yH92bDF/G8/OXGap:niS7ELGEi/AF+09BGMPre8oSIms
MD5 SHA1 SHA512 SSDEEP

Submit Download

bsod.exe

Path C:\Users\Admin\AppData\Local\Temp\bsod.exe
Size 274KB
SHA256 a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8
MD5 f1896231e9622dd044601962a9866a77
SHA1 36ad39e7d797ae43ee415e90a2dc234e0be3087b
SHA512 e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901
SSDEEP 1536:LTQNvkfdX9d+ZEekYn/A5PjzAEeyWTcZOC+0VA+BwnMmYcLvA9yH92bDF/G8/OXt:XQWfdXLGEi/AF+09BGMPre8oSIms
MD5 SHA1 SHA512 SSDEEP

Submit Download

z666.bat

Path C:\Users\Admin\AppData\Local\Temp\z666.bat
Size 691B
SHA256 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef
MD5 ee655674ba8e05d5a4c32de58a6757c1
SHA1 f06f54710d5a0b341a9e6d467e1bb1a78f2f9606
SHA512 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd
MD5 SHA1 SHA512

Submit Download

NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY N1 WAY.txt

Path C:\Users\Admin\Desktop\NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY N1 WAY.txt
Size 912B
SHA256 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b
MD5 391403276c6df4a164b0544a3411c6c7
SHA1 c4c06a4c7710d1d8140b07abd4b7bcd4187485ab
SHA512 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8
MD5 SHA1 SHA512

Submit Download

memory/284-825-0x0000000002AB0000-0x0000000002AB1000-memory.dmp

Download

memory/2264-823-0x0000000002D90000-0x0000000002D91000-memory.dmp

Download

memory/2284-1-0x0000000000AA0000-0x000000000116A000-memory.dmp

Download

memory/2284-0-0x0000000073F50000-0x000000007463E000-memory.dmp

Download

memory/2284-2-0x0000000005430000-0x0000000005470000-memory.dmp

Download

memory/2284-824-0x0000000073F50000-0x000000007463E000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads