c761f18e13595c727af11f7440e2f031f486a8dd4fac2cfba9082b2deca9b0c4

General

Target
loader.exe
Size 33KB
Sample260823-afb13agg89
SHA256 c761f18e13595c727af11f7440e2f031f486a8dd4fac2cfba9082b2deca9b0c4
MD5 148dc08d5217bf62d9e8c9e3ad5c7735
SHA1 906bee5f7dd5ad0aea9760b8087a1b205a13c25b
SHA512 357ac9764a991ab8019cc824a6353bebcfe8f5eae0fde22139fe2ed68a8d48d6cade7fc8ef7d63ff16b2a5b6ee66cff19a710a723e6e26727ae0146d04bfda44
SSDEEP 768:0sET7RmJuQ6ZzEG1o9IoZyiDsR/etEdFt8BjhBB:A9mJuVZ4aoTZyiDshetEdFtg
TLSH
T1EFF2098F738398EDC51AD178E4F78371E5B0FC6219345B3E4260D2361E38A949A7CA4B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\spool\drivers\color\mscms.dll	loader.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5732	cmd.exe
4488	cmd.exe
700	cmd.exe
1772	cmd.exe
1328	cmd.exe
5624	cmd.exe
5648	cmd.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocServer32\ThreadingModel = "Apartment"	loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocServer32	loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\CLSID	loader.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}	loader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\InprocServer32\ = "C:\\Windows\\System32\\spool\\drivers\\color\\mscms.dll"	loader.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4884	NOTEPAD.EXE

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3572	whoami.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 908 wrote to memory of 700	908	loader.exe	90
PID 700 wrote to memory of 4876	700	cmd.exe	91
PID 908 wrote to memory of 1772	908	loader.exe	92
PID 1772 wrote to memory of 4420	1772	cmd.exe	93
PID 4420 wrote to memory of 4436	4420	net.exe	94
PID 908 wrote to memory of 1328	908	loader.exe	96
PID 1328 wrote to memory of 1820	1328	cmd.exe	97
PID 1820 wrote to memory of 3340	1820	net.exe	98
PID 908 wrote to memory of 5624	908	loader.exe	100
PID 5624 wrote to memory of 1104	5624	cmd.exe	101
PID 1104 wrote to memory of 4380	1104	net.exe	102
PID 908 wrote to memory of 5648	908	loader.exe	103
PID 5648 wrote to memory of 4992	5648	cmd.exe	104
PID 4992 wrote to memory of 1564	4992	net.exe	105
PID 908 wrote to memory of 5732	908	loader.exe	106
PID 5732 wrote to memory of 3572	5732	cmd.exe	107
PID 908 wrote to memory of 4488	908	loader.exe	108

C:\Users\Admin\AppData\Local\Temp\loader.exe
"C:\Users\Admin\AppData\Local\Temp\loader.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c rundll32.exe shell32.dll,SHCreateLocalServerRunDll {DCB00C01-570F-4A9B-8D69-199FDBA5723B}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\system32\rundll32.exe
    rundll32.exe shell32.dll,SHCreateLocalServerRunDll {DCB00C01-570F-4A9B-8D69-199FDBA5723B}
    3⤵
    PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop spooler > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\net.exe
    net stop spooler
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop spooler
      4⤵
      PID:4436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net start spooler > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\system32\net.exe
    net start spooler
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1820
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start spooler
      4⤵
      PID:3340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net stop wuauserv > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\system32\net.exe
    net stop wuauserv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:4380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net start wuauserv > nul 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Windows\system32\net.exe
    net start wuauserv
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4992
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start wuauserv
      4⤵
      PID:1564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c whoami > C:\Windows\Temp\whoami.txt 2>&1
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\system32\whoami.exe
    whoami
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c type C:\Windows\Temp\whoami.txt
  2⤵
  - Executes a command shell one-liner
  PID:4488

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:4456

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1172

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Windows\Temp\whoami.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Privilege Escalation

Event Triggered Execution

1

T1546

Component Object Model Hijacking

1

T1546.015

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

whoami.txt

Path C:\Windows\Temp\whoami.txt
Size 16B
SHA256 f316632d4012430c17cb25042228b247c1255ea2bd56a49eda7e5c245814f2c2
MD5 6ca7d93efc2ebe5130eab6e8a11637b4
SHA1 503ee1ee28ca8747585317d5df8488ceaa358b1e
SHA512 19280b20a7c35f3b0290401077e124ea6814cd3be7644ab7ec5cc9eaa30d366499fe1bcd60b9e26e1cc6977c8422f497f22a19ebd6d4a6fffc5a7edff08fd5d2
MD5 SHA1 SHA512

Submit Download

memory/908-4-0x00007FF71D110000-0x00007FF71D11F000-memory.dmp

Download

Analysis

Sharing