lampion | 8002d87b9e8d6211c4748894cdb039eee927bc5777d3c5db52409e8cbab31715

Reason

Machine shutdown

General

Target

8681d7bd5c2d5ceff7611cb07ea020c1_JaffaCakes118.vbs
Size

11KB
MD5

8681d7bd5c2d5ceff7611cb07ea020c1
SHA1

28827a904d6c9808aa0ba72a1fe2c4a0930ebdf0
SHA256

8002d87b9e8d6211c4748894cdb039eee927bc5777d3c5db52409e8cbab31715
SHA512

b6891de86f450b06e19a76ee6488d61b5af326dc076475c87d64b64c053baca00c4d8a8ad80fe73e67ca032593e49e4c932e4531a619d4bc3262eb9db7d61d4b
SSDEEP

192:E9FeVYIAvL5ojSBcaRZpA4zeOI4KhMort6lI4Ob6F7Nz1lSA9HYBzv++365q:EeVaqjSBd64KXtD4ObUTSA9y3kq

Score

10^/10

lampion banker trojan

Malware Config

Signatures

Lampion
Lampion is a banking trojan, targeting Portuguese speaking countries.
trojan banker lampion
Blocklisted process makes network request 7 IoCs

Processes:

WScript.exe

flow pid process

4 3500 WScript.exe
6 3500 WScript.exe
8 3500 WScript.exe
10 3500 WScript.exe
12 3500 WScript.exe
14 3500 WScript.exe
25 3500 WScript.exe

flow	pid	process
4	3500	WScript.exe
6	3500	WScript.exe
8	3500	WScript.exe
10	3500	WScript.exe
12	3500	WScript.exe
14	3500	WScript.exe
25	3500	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wscript.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	wscript.exe

Drops startup file 1 IoCs

Processes:

wscript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hioeugwdmxz.lnk wscript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hioeugwdmxz.lnk	wscript.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "217"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

shutdown.exe

description pid process

Token: SeShutdownPrivilege 5708 shutdown.exe
Token: SeRemoteShutdownPrivilege 5708 shutdown.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

5448 LogonUI.exe

description	pid	process
Token: SeShutdownPrivilege	5708	shutdown.exe
Token: SeRemoteShutdownPrivilege	5708	shutdown.exe

pid	process
5448	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exewscript.execmd.exe

description	pid	process	target process
PID 3500 wrote to memory of 1232	3500	WScript.exe	wscript.exe
PID 3500 wrote to memory of 1232	3500	WScript.exe	wscript.exe
PID 1232 wrote to memory of 4260	1232	wscript.exe	cmd.exe
PID 1232 wrote to memory of 4260	1232	wscript.exe	cmd.exe
PID 4260 wrote to memory of 5708	4260	cmd.exe	shutdown.exe
PID 4260 wrote to memory of 5708	4260	cmd.exe	shutdown.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8681d7bd5c2d5ceff7611cb07ea020c1_JaffaCakes118.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\System32\wscript.exe
  wscript.exe C:\Users\Admin\AppData\Roaming\hioeugwdmxz.vbs
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c shutdown /r /t 0 /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\system32\shutdown.exe
      shutdown /r /t 0 /f
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5708

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39be055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\91859486520290\sqbpfjhxpzmimuvaj65881948351859.exe

Filesize
311B

MD5
a4fe2d959f9b12b98f3e398611520bee

SHA1
94ba202b5724e0c7f8c80ff791cb53acc5f7c188

SHA256
bca7a66cfa7255ab7276bcb631c41f1d5d68553d3ab92a581dc2265391b52f79

SHA512
d00162ceb44561043032fa1543a8f77ab90b4cda5b435630512c0f28b69528bcb8b2692c349215e49f315698b41896de28598fd09c820f1c6d42b4c921b12530

Download Submit
C:\Users\Admin\AppData\Roaming\hioeugwdmxz.vbs

Filesize
675B

MD5
88448a4dfdcfd268e941a7130efe68c1

SHA1
eb92812367e7bea92d3a242436c6118944e47d13

SHA256
3d29fa4ea423767279ad4387d09a13e2fc3a7e739e9b81b5ba1ce5b39ae8a897

SHA512
8b9b2ecaa385e0160cfd523b7e9ad193716c8037fc6e4d7d555a8a504412c8304f06da2e23c6a557bd7596f2d25bccd717f7616ea9a98cef3a0c325743341011

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads