ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb

General

Target
156.exe
Size 210KB
Sample260806-scddtstemb
SHA256 ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb
MD5 0bf9c0b1d4a43f5986fa08f087b04cae
SHA1 328b8542e3faeed47a959ab94ac2e4f1d39d2951
SHA512 10a1ed5bd4cbcd9e6181564ff149009e4b685e9310631cc95f51e5065e22f8017401f91e3f69ddd2985bde88ed35983c43e00b2b3322b9b5aca595e5125276c7
SSDEEP 6144:IEhfGkHBdZknRtjULx9aygCSCpMW90KImQijnfbCL:r++dij
TLSH
T18B244D98136AC93DC2BE27BED0A611060BF5B217D503E74CAFF8A0E66D37311A715A47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\156.exe\""	156.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\156.exe\" -startup"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\156.exe\" --init"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\156.exe\""	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\156.exe\" /setup"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\156.exe\" --wininit"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	156.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	156.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1028	cmd.exe
2020	cmd.exe
1276	cmd.exe
1224	cmd.exe
3232	cmd.exe
1436	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
2896	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3440	156.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3440	156.exe
Token: SeDebugPrivilege	2896	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 1028	3440	156.exe	91
PID 3440 wrote to memory of 1436	3440	156.exe	92
PID 3440 wrote to memory of 3232	3440	156.exe	93
PID 3440 wrote to memory of 1224	3440	156.exe	94
PID 3440 wrote to memory of 1276	3440	156.exe	95
PID 3440 wrote to memory of 2020	3440	156.exe	96
PID 3440 wrote to memory of 2896	3440	156.exe	97
PID 1436 wrote to memory of 1652	1436	cmd.exe	116
PID 1224 wrote to memory of 3988	1224	cmd.exe	118
PID 1028 wrote to memory of 1708	1028	cmd.exe	119
PID 1276 wrote to memory of 2496	1276	cmd.exe	122
PID 2020 wrote to memory of 1676	2020	cmd.exe	123
PID 1436 wrote to memory of 2224	1436	cmd.exe	124
PID 3232 wrote to memory of 4244	3232	cmd.exe	125
PID 3232 wrote to memory of 3868	3232	cmd.exe	126
PID 2020 wrote to memory of 592	2020	cmd.exe	127
PID 1224 wrote to memory of 4112	1224	cmd.exe	128
PID 1028 wrote to memory of 4916	1028	cmd.exe	129
PID 1276 wrote to memory of 2200	1276	cmd.exe	130

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3868	attrib.exe
592	attrib.exe
2200	attrib.exe
1652	attrib.exe
4244	attrib.exe
4112	attrib.exe
4916	attrib.exe
1708	attrib.exe
3988	attrib.exe
2496	attrib.exe
1676	attrib.exe
2224	attrib.exe

C:\Users\Admin\AppData\Local\Temp\156.exe
"C:\Users\Admin\AppData\Local\Temp\156.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:1708
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1652
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2224
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4244
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3868
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:3988
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4112
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1276
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2496
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2200
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:1676
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:592
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2896

C:\Users\Admin\AppData\Local\Temp\156.exe
"C:\Users\Admin\AppData\Local\Temp\156.exe" /setup
1⤵
PID:2888

C:\Users\Admin\AppData\Local\Temp\156.exe
"C:\Users\Admin\AppData\Local\Temp\156.exe"
1⤵
PID:4908

C:\Users\Admin\AppData\Local\Temp\156.exe
"C:\Users\Admin\AppData\Local\Temp\156.exe" --init
1⤵
PID:4956

C:\Users\Admin\AppData\Local\Temp\156.exe
"C:\Users\Admin\AppData\Local\Temp\156.exe" --wininit
1⤵
PID:4516

C:\Users\Admin\AppData\Local\Temp\156.exe
"C:\Users\Admin\AppData\Local\Temp\156.exe" -startup
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

156.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\156.exe.log
Size 1KB
SHA256 c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884
MD5 2d2a235f1b0f4b608c5910673735494b
SHA1 23a63f6529bfdf917886ab8347092238db0423a0
SHA512 10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086
TLSH
T1C031DE712372B1D889163F431C2D2AC007BF4769B660EE0C7598625ED9260175F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Desktop\info-Locker.txt
Size 206B
SHA256 7afcc363a9ccd7ba6d4d13d67bc1d8e3e023f9fc55678a51f05319581775ef30
MD5 7f465fd2523759303502f980d76a535f
SHA1 ffe9c8a3a90166e175de984b1cc23787b38fe4b0
SHA512 4ef7afa32a35a3d23b03ab2c30faf99b27ba9fe5799914a2b4cdf943403fd3df08f2d220674504a32d87a993893062846838ef932e2fb267939f3ce85617660b
MD5 SHA1 SHA512

Submit Download

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 206B
SHA256 6b33cb3f88d99b119f34fbabdf9c43a1d3c4bf409e1e56691b8c7f68ab826e73
MD5 149df65ee8d75cc818c77637fee69eff
SHA1 dd9f49b83e4303f39e90245caf559ae7e67f3c63
SHA512 51b954ce5ba7d8f185ac2c21985c8889511af02fcd7c37a104d8e1ed975c3dd0630984429661bd263b9057102e363ed76109a2ed5d6eef92f838f41fdb319cb6
MD5 SHA1 SHA512

Submit Download

memory/3440-0-0x0000000000AD0000-0x0000000000B0A000-memory.dmp

Download

memory/3440-1-0x000000001B7E0000-0x000000001B7F0000-memory.dmp

Download

memory/3440-19-0x000000001B7E0000-0x000000001B7F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads