41c4ce0997c63ab41874dae9ccc0b4922d7426eb25f5a4640fcbf0ee89002fa0

General

Target
Stub.exe
Size 209KB
Sample260421-b45tqaax2t
SHA256 41c4ce0997c63ab41874dae9ccc0b4922d7426eb25f5a4640fcbf0ee89002fa0
MD5 3ae6028d14180f116af3ab3e3bdd49e4
SHA1 7752b122ce3763f6c1a11694b2c11aa50e577a8c
SHA512 6bf0ea273ff85f2f3ce54f2173bb199b7eae7e5a77d30f2c68379ee75bc1220f82bcb0976acc6637a4ec70dd6c5404d9131e6a0dca0d52412f9901c90fe5f356
SSDEEP 6144:608A/ehUOqx8PBgnRtQ0UiB97SCpMW90KImQijnCbJewO:6XAwUOqx8PijQo
TLSH
T1DC2449981397897DD63D237ED0A1120907F56223C507F34E9EE5E4F89E2B3129B22B97
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Stub.exe\""	Stub.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Stub.exe\" --init"	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Stub.exe\" /setup"	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Stub.exe\" -startup"	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Stub.exe\""	Stub.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1383858298-2057492509-1726743289-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Stub.exe\" --wininit"	Stub.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3872	cmd.exe
1828	cmd.exe
3656	cmd.exe
4304	cmd.exe
4380	cmd.exe
4700	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2500	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4292	Stub.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	Stub.exe
Token: SeDebugPrivilege	2500	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4700	4292	Stub.exe	80
PID 4292 wrote to memory of 4380	4292	Stub.exe	81
PID 4292 wrote to memory of 4304	4292	Stub.exe	82
PID 4292 wrote to memory of 3656	4292	Stub.exe	83
PID 4292 wrote to memory of 1828	4292	Stub.exe	84
PID 4292 wrote to memory of 3872	4292	Stub.exe	85
PID 4292 wrote to memory of 2500	4292	Stub.exe	86
PID 4700 wrote to memory of 4584	4700	cmd.exe	94
PID 4700 wrote to memory of 1672	4700	cmd.exe	95
PID 3872 wrote to memory of 3344	3872	cmd.exe	96
PID 4304 wrote to memory of 3404	4304	cmd.exe	100
PID 1828 wrote to memory of 892	1828	cmd.exe	99
PID 4380 wrote to memory of 5008	4380	cmd.exe	97
PID 3656 wrote to memory of 3864	3656	cmd.exe	98
PID 4304 wrote to memory of 5112	4304	cmd.exe	101
PID 3656 wrote to memory of 2060	3656	cmd.exe	102
PID 1828 wrote to memory of 4984	1828	cmd.exe	103
PID 4380 wrote to memory of 3296	4380	cmd.exe	104
PID 3872 wrote to memory of 4456	3872	cmd.exe	105

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4584	attrib.exe
3344	attrib.exe
892	attrib.exe
3864	attrib.exe
5008	attrib.exe
3404	attrib.exe
5112	attrib.exe
2060	attrib.exe
1672	attrib.exe
4984	attrib.exe
3296	attrib.exe
4456	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Stub.exe
"C:\Users\Admin\AppData\Local\Temp\Stub.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4584
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:5008
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3296
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3404
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:5112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3864
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2060
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1828
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:892
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted! Telegram for contact: @%username% 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3872
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3344
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4456
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

info-Locker.txt

Path F:\info-Locker.txt
Size 72B
SHA256 3a998f7c69c9db91ecf975778a780441375caa5e48f7d8d0279c54a83fd42d4a
MD5 257ddc5f5a2f887af43cd5bd45419d87
SHA1 2a7198256c90d796b5229c87325fe25da0938d93
SHA512 66b8ec0812824e109073f26a6eda15d29d58253a1042310dbeda19a23bedcbb6eaaa6b2fa4bae0a681d54dbc1969d6d5ed1dce11b8d9da03eab7aea315bce7b6
TLSH
T1DDA012002D1862C4119110F2793160002478A40C2023184141001292101009019AA514
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4292-0-0x0000000000940000-0x000000000097A000-memory.dmp

Download

memory/4292-1-0x000000001B630000-0x000000001B640000-memory.dmp

Download

memory/4292-3-0x000000001B630000-0x000000001B640000-memory.dmp

Download

memory/4292-18-0x000000001B630000-0x000000001B640000-memory.dmp

Download

memory/4292-19-0x000000001B630000-0x000000001B640000-memory.dmp

Download

memory/4292-21-0x000000001B630000-0x000000001B640000-memory.dmp

Download

memory/4292-20-0x00000000011A0000-0x00000000011AC000-memory.dmp

Download

memory/4292-22-0x000000001B630000-0x000000001B640000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads