Analysis
-
max time kernel
1359s -
max time network
1801s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10-08-2024 13:20
Static task
static1
Behavioral task
behavioral1
Sample
lolhahahackerwowohnoo.zip
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
lolhahahackerwowohnoo/hello.bat
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
lolhahahackerwowohnoo/wowcoolfile.png
Resource
win10v2004-20240802-en
General
-
Target
lolhahahackerwowohnoo/hello.bat
-
Size
2KB
-
MD5
d51621e27667aad9fa339cc33b26cc52
-
SHA1
6cbc2853cabf7f8b7fcd23c8f3ae10b3022b743a
-
SHA256
f01291a8fcde83ba8e8cf48b30491bd0cb49d4ff8f3a3a029094032a13d71305
-
SHA512
7a22494286a251945e7b1a735398be09105cd361aed033b0350bdecfd75e63d578513e20bf02a599b0ec616ece40254ed44c83ef4f7e18ab2b9de41c82a0bb82
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 36 4292 powershell.exe -
pid Process 380 powershell.exe 4292 powershell.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lolhahahackerwowohnoo\\wowcoolfile.png" reg.exe -
Delays execution with timeout.exe 5 IoCs
pid Process 3680 timeout.exe 2888 timeout.exe 4008 timeout.exe 1916 timeout.exe 2084 timeout.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 380 powershell.exe 380 powershell.exe 4292 powershell.exe 4292 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 380 powershell.exe Token: SeDebugPrivilege 4292 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3036 wrote to memory of 380 3036 cmd.exe 85 PID 3036 wrote to memory of 380 3036 cmd.exe 85 PID 3036 wrote to memory of 4968 3036 cmd.exe 86 PID 3036 wrote to memory of 4968 3036 cmd.exe 86 PID 3036 wrote to memory of 220 3036 cmd.exe 87 PID 3036 wrote to memory of 220 3036 cmd.exe 87 PID 3036 wrote to memory of 2516 3036 cmd.exe 89 PID 3036 wrote to memory of 2516 3036 cmd.exe 89 PID 3036 wrote to memory of 2084 3036 cmd.exe 90 PID 3036 wrote to memory of 2084 3036 cmd.exe 90 PID 3036 wrote to memory of 3608 3036 cmd.exe 93 PID 3036 wrote to memory of 3608 3036 cmd.exe 93 PID 3036 wrote to memory of 3680 3036 cmd.exe 94 PID 3036 wrote to memory of 3680 3036 cmd.exe 94 PID 3036 wrote to memory of 4740 3036 cmd.exe 96 PID 3036 wrote to memory of 4740 3036 cmd.exe 96 PID 3036 wrote to memory of 2888 3036 cmd.exe 97 PID 3036 wrote to memory of 2888 3036 cmd.exe 97 PID 3036 wrote to memory of 5080 3036 cmd.exe 102 PID 3036 wrote to memory of 5080 3036 cmd.exe 102 PID 3036 wrote to memory of 4008 3036 cmd.exe 103 PID 3036 wrote to memory of 4008 3036 cmd.exe 103 PID 3036 wrote to memory of 1468 3036 cmd.exe 106 PID 3036 wrote to memory of 1468 3036 cmd.exe 106 PID 3036 wrote to memory of 1916 3036 cmd.exe 107 PID 3036 wrote to memory of 1916 3036 cmd.exe 107 PID 3036 wrote to memory of 4292 3036 cmd.exe 109 PID 3036 wrote to memory of 4292 3036 cmd.exe 109
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\lolhahahackerwowohnoo\hello.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Add-Type -TypeDefinition @'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:380
-
-
C:\Windows\system32\reg.exereg add "HKCU\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\lolhahahackerwowohnoo\wowcoolfile.png" /f2⤵
- Sets desktop wallpaper using registry
PID:4968
-
-
C:\Windows\system32\rundll32.exeRUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters2⤵PID:220
-
-
C:\Windows\system32\msg.exemsg * "Error 404: Productivity not found. Did you try turning it off and on again?"2⤵PID:2516
-
-
C:\Windows\system32\timeout.exetimeout /t 4 /nobreak2⤵
- Delays execution with timeout.exe
PID:2084
-
-
C:\Windows\system32\msg.exemsg * "Error 500: Coffee is empty. Time to panic"2⤵PID:3608
-
-
C:\Windows\system32\timeout.exetimeout /t 4 /nobreak2⤵
- Delays execution with timeout.exe
PID:3680
-
-
C:\Windows\system32\msg.exemsg * "Error 403: Access to Netflix denied. Go outside for a change"2⤵PID:4740
-
-
C:\Windows\system32\timeout.exetimeout /t 4 /nobreak2⤵
- Delays execution with timeout.exe
PID:2888
-
-
C:\Windows\system32\msg.exemsg * "Error 301: Memes not loading. Did you check your WiFi connection?"2⤵PID:5080
-
-
C:\Windows\system32\timeout.exetimeout /t 4 /nobreak2⤵
- Delays execution with timeout.exe
PID:4008
-
-
C:\Windows\system32\msg.exemsg * "Error 999: The 'Enter' key is broken. Please perform a ritual dance to fix it."2⤵PID:1468
-
-
C:\Windows\system32\timeout.exetimeout /t 4 /nobreak2⤵
- Delays execution with timeout.exe
PID:1916
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command "Invoke-WebRequest -Uri 'https://mirrors.cicku.me/linuxmint/iso/stable/22/linuxmint-22-cinnamon-64bit.iso' -OutFile 'C:\Users\Admin\AppData\Local\Temp\lolhahahackerwowohnoo\linuxmint-22-cinnamon-64bit.iso'"2⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82