Analysis
-
max time kernel
9s -
max time network
49s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
26-07-2021 12:42
Behavioral task
behavioral1
Sample
e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
Errors
Reason
Remote task has failed: Machine shutdown
General
-
Target
e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe
-
Size
4.2MB
-
MD5
d985a6610213773a43584afe1107dbd9
-
SHA1
4e743e81dcb4df6e21aacd0ad2918a5b20586127
-
SHA256
e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d
-
SHA512
cb7779968bc632edd6531bae810953b8c4f12018c0a1fde483c75f074a10eb49d2824e64733c280daeabe373cdf95c2a3307e6cf91c200c0e34655657447fb07
Score
9/10
Malware Config
Signatures
-
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
pid Process 1944 bcdedit.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 1312 shutdown.exe Token: SeRemoteShutdownPrivilege 1312 shutdown.exe Token: SeShutdownPrivilege 1704 shutdown.exe Token: SeRemoteShutdownPrivilege 1704 shutdown.exe Token: SeShutdownPrivilege 1692 shutdown.exe Token: SeRemoteShutdownPrivilege 1692 shutdown.exe Token: SeShutdownPrivilege 1688 shutdown.exe Token: SeRemoteShutdownPrivilege 1688 shutdown.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1816 wrote to memory of 1944 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 27 PID 1816 wrote to memory of 1944 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 27 PID 1816 wrote to memory of 1944 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 27 PID 1816 wrote to memory of 1944 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 27 PID 1816 wrote to memory of 1312 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 28 PID 1816 wrote to memory of 1312 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 28 PID 1816 wrote to memory of 1312 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 28 PID 1816 wrote to memory of 1312 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 28 PID 1816 wrote to memory of 1704 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 29 PID 1816 wrote to memory of 1704 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 29 PID 1816 wrote to memory of 1704 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 29 PID 1816 wrote to memory of 1704 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 29 PID 1816 wrote to memory of 1692 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 30 PID 1816 wrote to memory of 1692 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 30 PID 1816 wrote to memory of 1692 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 30 PID 1816 wrote to memory of 1692 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 30 PID 1816 wrote to memory of 1688 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 31 PID 1816 wrote to memory of 1688 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 31 PID 1816 wrote to memory of 1688 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 31 PID 1816 wrote to memory of 1688 1816 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe"C:\Users\Admin\AppData\Local\Temp\e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\windows\system32\bcdedit.exec:\windows\Sysnative\bcdedit.exe /set {current} safeboot minimal2⤵
- Modifies boot configuration data using bcdedit
PID:1944
-
-
C:\Windows\SysWOW64\shutdown.exeshutdown /r /f /t 002⤵
- Suspicious use of AdjustPrivilegeToken
PID:1312
-
-
\??\c:\windows\SysWOW64\shutdown.exec:\windows\SysWOW64\shutdown.exe /r /f /t 002⤵
- Suspicious use of AdjustPrivilegeToken
PID:1704
-
-
\??\c:\windows\SysWOW64\shutdown.exec:\windows\System32\shutdown.exe /r /f /t 002⤵
- Suspicious use of AdjustPrivilegeToken
PID:1692
-
-
\??\c:\windows\system32\shutdown.exec:\windows\Sysnative\shutdown.exe /r /f /t 002⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1380
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1888