a06c8e1909640e666ff1053c31c4716dab707630a1bc6f432651edcc8538829d

General

Target

YourWindowsWillDieifyourunthisasadmin.exe
Size

709KB
MD5

4cf78f076ef4a827ee6ea9b9e91edc00
SHA1

34f59c9ab945fdbbd984f5d973e1ff4039c4e8d8
SHA256

a06c8e1909640e666ff1053c31c4716dab707630a1bc6f432651edcc8538829d
SHA512

dd14cd81731506347448fd3726057740966363e90c89f0830f720171a689fafbc155a9f8ac2d1f69413ada06a80dbf8016d1385640b490d2d9444264c6b01ea7
SSDEEP

12288:YU+9H3900EJqrekLEyTYQcDL/TNuUCziP6VFGO5lrEaKYNtcBvAuvlee2NCFbLkU:YU+9XNrenyktDLdYNtcdvQNC9wHAP5ck

Score

10^/10

credential_access defense_evasion discovery evasion persistence ransomware spyware stealer trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "nothing.exe"	YourWindowsWillDieifyourunthisasadmin.exe

Modifies firewall policy service 3 TTPs 2 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	YourWindowsWillDieifyourunthisasadmin.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	YourWindowsWillDieifyourunthisasadmin.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	YourWindowsWillDieifyourunthisasadmin.exe

Disables Task Manager via registry modification
evasion
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CmdLine = "nothing.exe"	YourWindowsWillDieifyourunthisasadmin.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	YourWindowsWillDieifyourunthisasadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"nothing.exe\""	YourWindowsWillDieifyourunthisasadmin.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	YourWindowsWillDieifyourunthisasadmin.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Desktop\Wallpaper = "\"\""	YourWindowsWillDieifyourunthisasadmin.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YourWindowsWillDieifyourunthisasadmin.exe

Modifies Control Panel 1 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\Desktop	YourWindowsWillDieifyourunthisasadmin.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command	YourWindowsWillDieifyourunthisasadmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"nothing.exe\""	YourWindowsWillDieifyourunthisasadmin.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4840	YourWindowsWillDieifyourunthisasadmin.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
4840	YourWindowsWillDieifyourunthisasadmin.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	YourWindowsWillDieifyourunthisasadmin.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	YourWindowsWillDieifyourunthisasadmin.exe

C:\Users\Admin\AppData\Local\Temp\YourWindowsWillDieifyourunthisasadmin.exe
"C:\Users\Admin\AppData\Local\Temp\YourWindowsWillDieifyourunthisasadmin.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Impair Defenses: Safe Mode Boot
- Modifies system executable filetype association
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- System policy modification
PID:4840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4696