2181199b28b86022e3f975a3cec5d0f56fc13cb6385627e4a288063ce0b9b433

General

Target

9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
Size

500KB
MD5

c8c3a98c2916e96f5b8f07aeeb740066
SHA1

c4920da5ce4f8912186dca18404ce7a9327c8dab
SHA256

9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02
SHA512

17bbde312e5fdbcc2766c5f0d5895dab72439844b8b2f89e4e3207a1c9396c8254ad0f2ce47ddb4c8081e9aabb9a61aa982babe47adfa0ba3e456c38d338e1e2
SSDEEP

12288:+uRvXH+lNAFAvcE4vIKvQDsORs0hqK4vF:+gfelySvcE4vIKvUTRsRK8F

Score

10^/10

evasion persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty"	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

Disables Task Manager via registry modification
evasion
Drops desktop.ini file(s) 1 IoCs

Processes:

9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

description ioc process

File created C:\Users\Admin\Downloads\desktop.ini 9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\desktop.ini	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\Desktop\Wallpaper	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

pid	process
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

description pid process

Token: SeDebugPrivilege 3752 9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

description	pid	process
Token: SeDebugPrivilege	3752	9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe

C:\Users\Admin\AppData\Local\Temp\9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe
"C:\Users\Admin\AppData\Local\Temp\9aaeb479b6bb61b97d6843d8681229ec1873acd0b488d575d71956c8d1ad1b02.exe"
1⤵
- Modifies WinLogon for persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3752-0-0x00007FFD56C43000-0x00007FFD56C45000-memory.dmp

Filesize
8KB

Download
memory/3752-1-0x0000000000D30000-0x0000000000DB2000-memory.dmp

Filesize
520KB

Download
memory/3752-2-0x00007FFD56C40000-0x00007FFD57701000-memory.dmp

Filesize
10.8MB

Download
memory/3752-3-0x00007FFD56C40000-0x00007FFD57701000-memory.dmp

Filesize
10.8MB

Download
memory/3752-4-0x00007FFD56C40000-0x00007FFD57701000-memory.dmp

Filesize
10.8MB

Download
memory/3752-41-0x00007FFD56C43000-0x00007FFD56C45000-memory.dmp

Filesize
8KB

Download
memory/3752-42-0x00007FFD56C40000-0x00007FFD57701000-memory.dmp

Filesize
10.8MB

Download
memory/3752-43-0x00007FFD56C40000-0x00007FFD57701000-memory.dmp

Filesize
10.8MB

Download
memory/3752-44-0x00007FFD56C40000-0x00007FFD57701000-memory.dmp

Filesize
10.8MB

Download
memory/3752-45-0x000000001BB00000-0x000000001BCA9000-memory.dmp

Filesize
1.7MB

Download
memory/3752-46-0x00007FFD56C40000-0x00007FFD57701000-memory.dmp

Filesize
10.8MB

Download
memory/3752-47-0x000000001BB00000-0x000000001BCA9000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads