9c79013b150f0c7ec20b2470dec8164be2000bf7903e4d12a6024df0426dbcc3

Reason

Machine shutdown

General

Target
blue278.exe
Size 6.9MB
Sample260809-ylmlraxzev
SHA256 9c79013b150f0c7ec20b2470dec8164be2000bf7903e4d12a6024df0426dbcc3
MD5 3a09746b847207d1ba73f88132c66fd9
SHA1 d9d0500ed4f81c521e2fdfe881abb3dd2bdb8ded
SHA512 252a099ba7f955dc53e5b377bb5265a5f33e648a0da5f0e78383b5f0d8b5f854cbdcd4390534038b0adb145962c108c9f5422079ebebd6d1f71ab377a0fcf565
SSDEEP 49152:OXZnb5gP/XVndL50tCvj7c3/EKb6BGiGHiTKvB5vq0QciaGaCdUocpN5S0uyT/jc:OXB9Y2vvElXaZv75xAcPw8dE
TLSH
T158765A03EDA528E9C1AED175897791537F617C885B2163D32B90F2243F76BE0AEB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21\\264b34a5\\svchost.exe\""	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
4132	svchost.exe
4792	svchost.exe
4164	svchost.exe
2492	svchost.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsMediaService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21\\264b34a5\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsMediaService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21\\264b34a5\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsMediaService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21\\264b34a5\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsMediaService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21\\264b34a5\\svchost.exe\""	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsMediaService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21\\8f778318\\svchost.exe\""	blue278.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsMediaService = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21\\8f778318\\svchost.exe\""	blue278.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
12	api.ipify.org
13	api.ipify.org

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4052	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3360	LogonUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4132	4632	blue278.exe	86
PID 4792 wrote to memory of 4164	4792	svchost.exe	89
PID 4164 wrote to memory of 4052	4164	svchost.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\blue278.exe
"C:\Users\Admin\AppData\Local\Temp\blue278.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21\8f778318\svchost.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21\8f778318\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:4132

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21\8f778318\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21\8f778318\svchost.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21\264b34a5\svchost.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21\264b34a5\svchost.exe
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\system32\schtasks.exe
    schtasks /Create /F /TN "\Microsoft\Windows\Media Center\MediaSvc" /TR \"C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21\264b34a5\svchost.exe\" /SC ONLOGON /RL HIGHEST /RU SYSTEM
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4052

C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21\264b34a5\svchost.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21\264b34a5\svchost.exe"
1⤵
- Executes dropped EXE
PID:2492

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3949055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Event Triggered Execution

1

T1546

Image File Execution Options Injection

1

T1546.012

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.santa_marker

Path C:\Users\Admin\AppData\Local\Temp\.santa_marker
Size 136B
SHA256 bade3ab951455487165b81f99c1a55197c75149ef4705ebe72ee2dca7d69a6ec
MD5 4d82b8c5724d345ee9441ef89d266b0e
SHA1 85faef6a7c6647c9ef10ebde8f7b1c5ba19038c0
SHA512 04e790b771d707e045e9ddc41348447b4157a1e36d63713114cf588a7d5fa6111b1ba6b7122a0c347a8d5145e6969913b406e0390e32ba9a2c926e8ddda930df
TLSH
T1C1C02B108080E603F44013801234D9C7427703AA74500F1D05400A88458343CC42A603
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21\8f778318\svchost.exe
Size 6.9MB
SHA256 9c79013b150f0c7ec20b2470dec8164be2000bf7903e4d12a6024df0426dbcc3
MD5 3a09746b847207d1ba73f88132c66fd9
SHA1 d9d0500ed4f81c521e2fdfe881abb3dd2bdb8ded
SHA512 252a099ba7f955dc53e5b377bb5265a5f33e648a0da5f0e78383b5f0d8b5f854cbdcd4390534038b0adb145962c108c9f5422079ebebd6d1f71ab377a0fcf565
SSDEEP 49152:OXZnb5gP/XVndL50tCvj7c3/EKb6BGiGHiTKvB5vq0QciaGaCdUocpN5S0uyT/jc:OXB9Y2vvElXaZv75xAcPw8dE
TLSH
T158765A03EDA528E9C1AED175897791537F617C885B2163D32B90F2243F76BE0AEB9340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads