e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d

Reason

Remote task has failed: Machine shutdown

General

Target

e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe
Size

4.2MB
MD5

d985a6610213773a43584afe1107dbd9
SHA1

4e743e81dcb4df6e21aacd0ad2918a5b20586127
SHA256

e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d
SHA512

cb7779968bc632edd6531bae810953b8c4f12018c0a1fde483c75f074a10eb49d2824e64733c280daeabe373cdf95c2a3307e6cf91c200c0e34655657447fb07

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exe

pid process

1944 bcdedit.exe

pid	process
1944	bcdedit.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

shutdown.exeshutdown.exeshutdown.exeshutdown.exe

description	pid	process
Token: SeShutdownPrivilege	1312	shutdown.exe
Token: SeRemoteShutdownPrivilege	1312	shutdown.exe
Token: SeShutdownPrivilege	1704	shutdown.exe
Token: SeRemoteShutdownPrivilege	1704	shutdown.exe
Token: SeShutdownPrivilege	1692	shutdown.exe
Token: SeRemoteShutdownPrivilege	1692	shutdown.exe
Token: SeShutdownPrivilege	1688	shutdown.exe
Token: SeRemoteShutdownPrivilege	1688	shutdown.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe

description	pid	process	target process
PID 1816 wrote to memory of 1944	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	bcdedit.exe
PID 1816 wrote to memory of 1944	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	bcdedit.exe
PID 1816 wrote to memory of 1944	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	bcdedit.exe
PID 1816 wrote to memory of 1944	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	bcdedit.exe
PID 1816 wrote to memory of 1312	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1312	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1312	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1312	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1704	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1704	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1704	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1704	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1692	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1692	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1692	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1692	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1688	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1688	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1688	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 1816 wrote to memory of 1688	1816	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe

C:\Users\Admin\AppData\Local\Temp\e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe
"C:\Users\Admin\AppData\Local\Temp\e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- \??\c:\windows\system32\bcdedit.exe
  c:\windows\Sysnative\bcdedit.exe /set {current} safeboot minimal
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1944
- C:\Windows\SysWOW64\shutdown.exe
  shutdown /r /f /t 00
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- \??\c:\windows\SysWOW64\shutdown.exe
  c:\windows\SysWOW64\shutdown.exe /r /f /t 00
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1704
- \??\c:\windows\SysWOW64\shutdown.exe
  c:\windows\System32\shutdown.exe /r /f /t 00
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- \??\c:\windows\system32\shutdown.exe
  c:\windows\Sysnative\shutdown.exe /r /f /t 00
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1688

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1380

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1888

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1312-61-0x0000000000000000-mapping.dmp

Download
memory/1380-65-0x000007FEFBD61000-0x000007FEFBD63000-memory.dmp

Filesize
8KB

Download
memory/1380-66-0x0000000002900000-0x0000000002901000-memory.dmp

Filesize
4KB

Download
memory/1688-64-0x0000000000000000-mapping.dmp

Download
memory/1692-63-0x0000000000000000-mapping.dmp

Download
memory/1704-62-0x0000000000000000-mapping.dmp

Download
memory/1888-68-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/1944-60-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors