b6f0422e0ce7fd8f2ad23bc2ff2fab72b331e252810ce7a4582217a3bea32c67

Reason

Machine shutdown

General

Target

action_2.0.8.9.vir.exe
Size

380KB
MD5

11b3ae60c845189bbec476f762476e69
SHA1

28461e56f09813363ccc1fa686e48938afde7ec4
SHA256

b6f0422e0ce7fd8f2ad23bc2ff2fab72b331e252810ce7a4582217a3bea32c67
SHA512

4b235b560f0cd9d011017aec3ccbe5636a3c78905ecc401403ec2e01db809bfa3c4ecf973615ded1b54041c7e0a572ac9e6031fd56615a3621d4a9351c40c88e

Score

10^/10

evasion trojan ransomware bootkit persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 90 IoCs

Processes:

action_2.0.8.9.vir.exetuup.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1260 wrote to memory of 1564	1260	action_2.0.8.9.vir.exe	tuup.exe
PID 1260 wrote to memory of 1564	1260	action_2.0.8.9.vir.exe	tuup.exe
PID 1260 wrote to memory of 1564	1260	action_2.0.8.9.vir.exe	tuup.exe
PID 1564 wrote to memory of 1832	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 1832	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 1832	1564	tuup.exe	cmd.exe
PID 1832 wrote to memory of 2148	1832	cmd.exe	sc.exe
PID 1832 wrote to memory of 2148	1832	cmd.exe	sc.exe
PID 1832 wrote to memory of 2148	1832	cmd.exe	sc.exe
PID 1564 wrote to memory of 2184	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 2184	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 2184	1564	tuup.exe	cmd.exe
PID 1260 wrote to memory of 2604	1260	action_2.0.8.9.vir.exe	cmd.exe
PID 1260 wrote to memory of 2604	1260	action_2.0.8.9.vir.exe	cmd.exe
PID 1260 wrote to memory of 2604	1260	action_2.0.8.9.vir.exe	cmd.exe
PID 2184 wrote to memory of 2772	2184	cmd.exe	sc.exe
PID 2184 wrote to memory of 2772	2184	cmd.exe	sc.exe
PID 2184 wrote to memory of 2772	2184	cmd.exe	sc.exe
PID 1564 wrote to memory of 3924	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3924	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3924	1564	tuup.exe	cmd.exe
PID 3924 wrote to memory of 4032	3924	cmd.exe	sc.exe
PID 3924 wrote to memory of 4032	3924	cmd.exe	sc.exe
PID 3924 wrote to memory of 4032	3924	cmd.exe	sc.exe
PID 1564 wrote to memory of 3956	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3956	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3956	1564	tuup.exe	cmd.exe
PID 3956 wrote to memory of 988	3956	cmd.exe	sc.exe
PID 3956 wrote to memory of 988	3956	cmd.exe	sc.exe
PID 3956 wrote to memory of 988	3956	cmd.exe	sc.exe
PID 1564 wrote to memory of 1872	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 1872	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 1872	1564	tuup.exe	cmd.exe
PID 1872 wrote to memory of 3528	1872	cmd.exe	sc.exe
PID 1872 wrote to memory of 3528	1872	cmd.exe	sc.exe
PID 1872 wrote to memory of 3528	1872	cmd.exe	sc.exe
PID 1564 wrote to memory of 3068	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3068	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3068	1564	tuup.exe	cmd.exe
PID 3068 wrote to memory of 3168	3068	cmd.exe	sc.exe
PID 3068 wrote to memory of 3168	3068	cmd.exe	sc.exe
PID 3068 wrote to memory of 3168	3068	cmd.exe	sc.exe
PID 1564 wrote to memory of 3664	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3664	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3664	1564	tuup.exe	cmd.exe
PID 3664 wrote to memory of 1012	3664	cmd.exe	sc.exe
PID 3664 wrote to memory of 1012	3664	cmd.exe	sc.exe
PID 3664 wrote to memory of 1012	3664	cmd.exe	sc.exe
PID 1564 wrote to memory of 3716	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3716	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3716	1564	tuup.exe	cmd.exe
PID 3716 wrote to memory of 3712	3716	cmd.exe	sc.exe
PID 3716 wrote to memory of 3712	3716	cmd.exe	sc.exe
PID 3716 wrote to memory of 3712	3716	cmd.exe	sc.exe
PID 1564 wrote to memory of 3864	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3864	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 3864	1564	tuup.exe	cmd.exe
PID 3864 wrote to memory of 1732	3864	cmd.exe	schtasks.exe
PID 3864 wrote to memory of 1732	3864	cmd.exe	schtasks.exe
PID 3864 wrote to memory of 1732	3864	cmd.exe	schtasks.exe
PID 1564 wrote to memory of 2164	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 2164	1564	tuup.exe	cmd.exe
PID 1564 wrote to memory of 2164	1564	tuup.exe	cmd.exe
PID 2164 wrote to memory of 2008	2164	cmd.exe	schtasks.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

3360 LogonUI.exe
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Disabling Security Tools
T1089

Service Stop
T1489

pid	process
3360	LogonUI.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe

Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs
Enables rebooting of the machine without requiring login credentials.
ransomware bootkit

Winlogon Helper DLL
T1004

Modify Registry
T1112

Processes:

LogonUI.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked LogonUI.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

action_2.0.8.9.vir.exetuup.exe

description pid process

Token: SeSecurityPrivilege 1260 action_2.0.8.9.vir.exe
Token: SeShutdownPrivilege 1564 tuup.exe
Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked	LogonUI.exe

description	pid	process
Token: SeSecurityPrivilege	1260	action_2.0.8.9.vir.exe
Token: SeShutdownPrivilege	1564	tuup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

action_2.0.8.9.vir.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\Currentversion\Run	action_2.0.8.9.vir.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\{AEB8DB6C-912E-B479-54E9-8D33B257E09E} = "C:\\Users\\Admin\\AppData\\Roaming\\Pyohva\\tuup.exe"	action_2.0.8.9.vir.exe

Executes dropped EXE 1 IoCs

Processes:

tuup.exe

pid process

1564 tuup.exe

pid	process
1564	tuup.exe

C:\Users\Admin\AppData\Local\Temp\action_2.0.8.9.vir.exe
"C:\Users\Admin\AppData\Local\Temp\action_2.0.8.9.vir.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Adds Run key to start application
PID:1260

C:\Users\Admin\AppData\Roaming\Pyohva\tuup.exe
"C:\Users\Admin\AppData\Roaming\Pyohva\tuup.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1564

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c sc stop wuauserv
3⤵
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\SysWOW64\sc.exe
sc stop wuauserv
4⤵
PID:2148

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c sc config wuauserv start= disabled
3⤵
- Suspicious use of WriteProcessMemory
PID:2184

C:\Windows\SysWOW64\sc.exe
sc config wuauserv start= disabled
4⤵
PID:2772

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c sc stop wscsvc
3⤵
- Suspicious use of WriteProcessMemory
PID:3924

C:\Windows\SysWOW64\sc.exe
sc stop wscsvc
4⤵
PID:4032

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c sc config wscsvc start= disabled
3⤵
- Suspicious use of WriteProcessMemory
PID:3956

C:\Windows\SysWOW64\sc.exe
sc config wscsvc start= disabled
4⤵
PID:988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c sc stop WinDefend
3⤵
- Suspicious use of WriteProcessMemory
PID:1872

C:\Windows\SysWOW64\sc.exe
sc stop WinDefend
4⤵
PID:3528

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c sc config WinDefend start= disabled
3⤵
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\sc.exe
sc config WinDefend start= disabled
4⤵
PID:3168

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c sc stop WdNisSvc
3⤵
- Suspicious use of WriteProcessMemory
PID:3664

C:\Windows\SysWOW64\sc.exe
sc stop WdNisSvc
4⤵
PID:1012

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c sc config WdNisSvc start= disabled
3⤵
- Suspicious use of WriteProcessMemory
PID:3716

C:\Windows\SysWOW64\sc.exe
sc config WdNisSvc start= disabled
4⤵
PID:3712

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
3⤵
- Suspicious use of WriteProcessMemory
PID:3864

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
4⤵
PID:1732

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
3⤵
- Suspicious use of WriteProcessMemory
PID:2164

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
4⤵
PID:2008

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
3⤵
PID:2632

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
4⤵
PID:1300

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
3⤵
PID:2772

C:\Windows\SysWOW64\schtasks.exe
schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
4⤵
PID:3992

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c sc stop MpsSvc
3⤵
PID:3764

C:\Windows\SysWOW64\sc.exe
sc stop MpsSvc
4⤵
PID:4032

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c sc config MpsSvc start= disabled
3⤵
PID:3924

C:\Windows\SysWOW64\sc.exe
sc config MpsSvc start= disabled
4⤵
PID:952

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
3⤵
PID:3516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp62262603.bat" C:\Users\Admin\AppData\Local\Temp\action_2.0.8.9.vir.exe"
2⤵
PID:2604

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3acc055 /state1:0x41c64e6d
1⤵
- Suspicious use of SetWindowsHookEx
- Modifies data under HKEY_USERS
- Modifies WinLogon to allow AutoLogon
PID:3360

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

2

T1031

Winlogon Helper DLL

1

T1004

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

2

T1089

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp62262603.bat

Download Submit
C:\Users\Admin\AppData\Roaming\Pyohva\tuup.exe

Download Submit
C:\Users\Admin\AppData\Roaming\Pyohva\tuup.exe

Download Submit
memory/952-34-0x0000000000000000-mapping.dmp

Download
memory/988-14-0x0000000000000000-mapping.dmp

Download
memory/1012-20-0x0000000000000000-mapping.dmp

Download
memory/1260-0-0x00000000005FF000-0x0000000000602000-memory.dmp

Filesize
12KB

Download
memory/1300-28-0x0000000000000000-mapping.dmp

Download
memory/1564-4-0x000000000067D000-0x000000000067E000-memory.dmp

Filesize
4KB

Download
memory/1564-1-0x0000000000000000-mapping.dmp

Download
memory/1732-24-0x0000000000000000-mapping.dmp

Download
memory/1832-5-0x0000000000000000-mapping.dmp

Download
memory/1872-15-0x0000000000000000-mapping.dmp

Download
memory/2008-26-0x0000000000000000-mapping.dmp

Download
memory/2148-6-0x0000000000000000-mapping.dmp

Download
memory/2164-25-0x0000000000000000-mapping.dmp

Download
memory/2184-7-0x0000000000000000-mapping.dmp

Download
memory/2604-8-0x0000000000000000-mapping.dmp

Download
memory/2632-27-0x0000000000000000-mapping.dmp

Download
memory/2772-9-0x0000000000000000-mapping.dmp

Download
memory/2772-29-0x0000000000000000-mapping.dmp

Download
memory/3068-17-0x0000000000000000-mapping.dmp

Download
memory/3168-18-0x0000000000000000-mapping.dmp

Download
memory/3528-16-0x0000000000000000-mapping.dmp

Download
memory/3664-19-0x0000000000000000-mapping.dmp

Download
memory/3712-22-0x0000000000000000-mapping.dmp

Download
memory/3716-21-0x0000000000000000-mapping.dmp

Download
memory/3764-31-0x0000000000000000-mapping.dmp

Download
memory/3864-23-0x0000000000000000-mapping.dmp

Download
memory/3924-33-0x0000000000000000-mapping.dmp

Download
memory/3924-10-0x0000000000000000-mapping.dmp

Download
memory/3956-13-0x0000000000000000-mapping.dmp

Download
memory/3992-30-0x0000000000000000-mapping.dmp

Download
memory/4032-32-0x0000000000000000-mapping.dmp

Download
memory/4032-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads