6ae94bfc81dfe7bd664592c67ff224eec1c6e0a9bd47ba23a766260e86bf1095

Reason

Machine shutdown

General

Target
Wallpaperskibidi.exe
Size 65.1MB
Sample240801-gvrtdszerd
SHA256 6ae94bfc81dfe7bd664592c67ff224eec1c6e0a9bd47ba23a766260e86bf1095
MD5 5b30ac849b50ffe82ed799ce2a3401c2
SHA1 c2ca01eb618f22eac73d28d9919c3a5d52dd41a9
SHA512 97f70be971a70dd85999024b856c33b028959a8e1928e92a8a48306ee019e5f146abc040a7c954e7e9cf7c9f1d5635476bf16ee6ed64d36e5cd1bfba0b696e92
SSDEEP 393216:QkDkpjhB2dhR9JbPrtgNkyIOOR+cb19ZRIIYl6xX9ZzqtCQshHD26a14aBYWlx9y:QPpObRjhOOAcbfWbkQshHSYajxMt
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit ransomware

Malware Config

Signatures

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
812	takeown.exe
1140	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\International\Geo\Nation	Wallpaperskibidi.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1140	icacls.exe
812	takeown.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2077438316-259605770-1264560426-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\wallpaper.jpg"	Wallpaperskibidi.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\boot\resources\bootres.dll	Wallpaperskibidi.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "9"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	812	takeown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4920	LogonUI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 2688	744	Wallpaperskibidi.exe	90
PID 744 wrote to memory of 2688	744	Wallpaperskibidi.exe	90
PID 2688 wrote to memory of 812	2688	cmd.exe	92
PID 2688 wrote to memory of 812	2688	cmd.exe	92
PID 744 wrote to memory of 4520	744	Wallpaperskibidi.exe	93
PID 744 wrote to memory of 4520	744	Wallpaperskibidi.exe	93
PID 4520 wrote to memory of 1140	4520	cmd.exe	96
PID 4520 wrote to memory of 1140	4520	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Wallpaperskibidi.exe
"C:\Users\Admin\AppData\Local\Temp\Wallpaperskibidi.exe"
1⤵
- Checks computer location settings
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:744
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c takeown /f "C:\Windows\boot\resources\bootres.dll" /a
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\takeown.exe
    takeown /f "C:\Windows\boot\resources\bootres.dll" /a
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:812
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /c icacls "C:\Windows\boot\resources\bootres.dll" /grant administrators:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\system32\icacls.exe
    icacls "C:\Windows\boot\resources\bootres.dll" /grant administrators:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1140

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa394b855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

bootres.dll

Path C:\Windows\Boot\Resources\bootres.dll
Size 2.4MB
SHA256 7cd66f3681ddf1d947ec8a7c8809c5bb9447d2c4a3e90b4ec131b952b56cfab9
MD5 c9c37355d6287422dd57217322232edb
SHA1 94be414f99ae1d6f81fe5c6e599522cd401dff9d
SHA512 6df673e1244b52208d599e105609a40e735afd05cdf4fbdc2054752dbda9aa4fd870b5bd5e88d0dc177117e396177defb3f71de0c2e7fdc60abb360b169f5ac4
SSDEEP 49152:JLhmBYRgcGZbe1zjio6w52ey+tZ0f9AYTJlTOFfzXahd:TmVlZbu52eB8PTX2Xahd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

Errors