6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

240316-sq9desff3410

16/03/2024, 15:16

240316-sns9esdf2110

Analysis

max time kernel
4s
max time network
12s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Trojan/666.exe
Size 6.8MB
Sample240316-sq9desff34
SHA256 db6bbaa7de79fa26489c511fb59e996db796a491f047539fea8ef42107ff3eb6
MD5 63c96886aade3b86d982ad249ef7eb50
SHA1 12a56093ebfa3ba038742ab7e9a472727e70a3b5
SHA512 bcaf4f10292e4b15ab940457f13a917a323a47e03084e4694dab158d4c4f47807080407ceb206945b19a385411b7fb36d80ce39a07e1da7d88e38694b259c06c
SSDEEP 12288:+Rx0AYhMCua0AYhMCuulE0AYhMCud0AYhMCuf:+Rx0n3b0n3PlE0n3C0n3I
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

evasion persistence ransomware

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	666.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\Desktop\WallPaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.png"	666.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
3932	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "125"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\666.ico"	666.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	taskkill.exe
Token: SeIncreaseQuotaPrivilege	4804	WMIC.exe
Token: SeSecurityPrivilege	4804	WMIC.exe
Token: SeTakeOwnershipPrivilege	4804	WMIC.exe
Token: SeLoadDriverPrivilege	4804	WMIC.exe
Token: SeSystemProfilePrivilege	4804	WMIC.exe
Token: SeSystemtimePrivilege	4804	WMIC.exe
Token: SeProfSingleProcessPrivilege	4804	WMIC.exe
Token: SeIncBasePriorityPrivilege	4804	WMIC.exe
Token: SeCreatePagefilePrivilege	4804	WMIC.exe
Token: SeBackupPrivilege	4804	WMIC.exe
Token: SeRestorePrivilege	4804	WMIC.exe
Token: SeShutdownPrivilege	4804	WMIC.exe
Token: SeDebugPrivilege	4804	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4804	WMIC.exe
Token: SeRemoteShutdownPrivilege	4804	WMIC.exe
Token: SeUndockPrivilege	4804	WMIC.exe
Token: SeManageVolumePrivilege	4804	WMIC.exe
Token: 33	4804	WMIC.exe
Token: 34	4804	WMIC.exe
Token: 35	4804	WMIC.exe
Token: 36	4804	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4804	WMIC.exe
Token: SeSecurityPrivilege	4804	WMIC.exe
Token: SeTakeOwnershipPrivilege	4804	WMIC.exe
Token: SeLoadDriverPrivilege	4804	WMIC.exe
Token: SeSystemProfilePrivilege	4804	WMIC.exe
Token: SeSystemtimePrivilege	4804	WMIC.exe
Token: SeProfSingleProcessPrivilege	4804	WMIC.exe
Token: SeIncBasePriorityPrivilege	4804	WMIC.exe
Token: SeCreatePagefilePrivilege	4804	WMIC.exe
Token: SeBackupPrivilege	4804	WMIC.exe
Token: SeRestorePrivilege	4804	WMIC.exe
Token: SeShutdownPrivilege	4804	WMIC.exe
Token: SeDebugPrivilege	4804	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4804	WMIC.exe
Token: SeRemoteShutdownPrivilege	4804	WMIC.exe
Token: SeUndockPrivilege	4804	WMIC.exe
Token: SeManageVolumePrivilege	4804	WMIC.exe
Token: 33	4804	WMIC.exe
Token: 34	4804	WMIC.exe
Token: 35	4804	WMIC.exe
Token: 36	4804	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4596	WMIC.exe
Token: SeSecurityPrivilege	4596	WMIC.exe
Token: SeTakeOwnershipPrivilege	4596	WMIC.exe
Token: SeLoadDriverPrivilege	4596	WMIC.exe
Token: SeSystemProfilePrivilege	4596	WMIC.exe
Token: SeSystemtimePrivilege	4596	WMIC.exe
Token: SeProfSingleProcessPrivilege	4596	WMIC.exe
Token: SeIncBasePriorityPrivilege	4596	WMIC.exe
Token: SeCreatePagefilePrivilege	4596	WMIC.exe
Token: SeBackupPrivilege	4596	WMIC.exe
Token: SeRestorePrivilege	4596	WMIC.exe
Token: SeShutdownPrivilege	4596	WMIC.exe
Token: SeDebugPrivilege	4596	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4596	WMIC.exe
Token: SeRemoteShutdownPrivilege	4596	WMIC.exe
Token: SeUndockPrivilege	4596	WMIC.exe
Token: SeManageVolumePrivilege	4596	WMIC.exe
Token: 33	4596	WMIC.exe
Token: 34	4596	WMIC.exe
Token: 35	4596	WMIC.exe
Token: 36	4596	WMIC.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
540	666.exe
540	666.exe
1104	LogonUI.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 2808	540	666.exe	90
PID 540 wrote to memory of 2808	540	666.exe	90
PID 540 wrote to memory of 2808	540	666.exe	90
PID 2808 wrote to memory of 3932	2808	cmd.exe	92
PID 2808 wrote to memory of 3932	2808	cmd.exe	92
PID 2808 wrote to memory of 3932	2808	cmd.exe	92
PID 2808 wrote to memory of 4804	2808	cmd.exe	94
PID 2808 wrote to memory of 4804	2808	cmd.exe	94
PID 2808 wrote to memory of 4804	2808	cmd.exe	94
PID 2808 wrote to memory of 4596	2808	cmd.exe	95
PID 2808 wrote to memory of 4596	2808	cmd.exe	95
PID 2808 wrote to memory of 4596	2808	cmd.exe	95
PID 2808 wrote to memory of 5080	2808	cmd.exe	96
PID 2808 wrote to memory of 5080	2808	cmd.exe	96
PID 2808 wrote to memory of 5080	2808	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\666.exe"
1⤵
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\z666.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='No System Anymore'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'No System Anymore'
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /f /r /t 0
    3⤵
    PID:5080

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b9055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

NoSystemAnymore.exe

Path C:\Users\Admin\AppData\Local\Temp\NoSystemAnymore.exe
Size 273KB
SHA256 b1f25de77226ad8cf0e06226653e1c5aa7ac27a1ba8ba7bff8845685c2e53709
MD5 ef4e8ea4440efc48d5cd1a05a3a6f2a8
SHA1 74b5a40d4d9cb94ac7ed93b1cf9045539e50f068
SHA512 f7aaa82dacf0ceee3f8311c787a568fdbe0b322d47371ddab37427902ceb74d0b324d6335878366d40f4d5d2b04b00157b81c8bd7b5c7b27fdcd26c770c13bf4
SSDEEP 1536:nikbx7E9d+ZEekYn/A5PjzAEeyWTcZOC+0VA+BwnMmYcLvA9yH92bDF/G8/OXGap:niS7ELGEi/AF+09BGMPre8oSIms
MD5 SHA1 SHA512 SSDEEP

Submit Download

bsod.exe

Path C:\Users\Admin\AppData\Local\Temp\bsod.exe
Size 274KB
SHA256 a254d664351a6db50d98bebbd530c46e64f9b9455bf4f378254045b2cde971f8
MD5 f1896231e9622dd044601962a9866a77
SHA1 36ad39e7d797ae43ee415e90a2dc234e0be3087b
SHA512 e4004c3879b2b337260848e748c9d0b5e51bb4c8a8c317e44cedfe30e614391c329d1c07e7b052983897cc1010eee994c09cb370f721317f9c429c1d82e50901
SSDEEP 1536:LTQNvkfdX9d+ZEekYn/A5PjzAEeyWTcZOC+0VA+BwnMmYcLvA9yH92bDF/G8/OXt:XQWfdXLGEi/AF+09BGMPre8oSIms
MD5 SHA1 SHA512 SSDEEP

Submit Download

z666.bat

Path C:\Users\Admin\AppData\Local\Temp\z666.bat
Size 691B
SHA256 40cc0b6734258fc61e9940e359b7e0b84651e44a12943bb4381523a5cea325ef
MD5 ee655674ba8e05d5a4c32de58a6757c1
SHA1 f06f54710d5a0b341a9e6d467e1bb1a78f2f9606
SHA512 26bc97bff5612643c379776baf3637f7233748e7ecd8d8b94aa995e0a77d79c4c02d49ed98ef1bdc6d417bcf82e35069427692967c73d3b3899aff3868c93ebd
MD5 SHA1 SHA512

Submit Download

NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY N1 WAY.txt

Path C:\Users\Admin\Desktop\NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY NO WAY N1 WAY.txt
Size 912B
SHA256 524dcba7e6a293bc6a19c1522672598a71ff4def394ac696ec30ea99154d511b
MD5 391403276c6df4a164b0544a3411c6c7
SHA1 c4c06a4c7710d1d8140b07abd4b7bcd4187485ab
SHA512 2b0b05f4e8241ec07bd35f1a40113be5fa8689d5bfb8a4064a5c8dc119b10fe40b33697ad2e3195c068fa8cce5d7a860dbbbffebb45d8a9fc1ec121b6a5216f8
MD5 SHA1 SHA512

Submit Download

memory/540-0-0x00000000743C0000-0x0000000074B70000-memory.dmp

Download

memory/540-1-0x0000000000AD0000-0x000000000119A000-memory.dmp

Download

memory/540-2-0x0000000006160000-0x0000000006704000-memory.dmp

Download

memory/540-3-0x0000000005BB0000-0x0000000005C42000-memory.dmp

Download

memory/540-4-0x0000000005B30000-0x0000000005B40000-memory.dmp

Download

memory/540-5-0x0000000005D40000-0x0000000005D4A000-memory.dmp

Download

memory/540-821-0x00000000743C0000-0x0000000074B70000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads