Analysis
-
max time kernel
7s -
max time network
10s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
26-07-2021 12:42
Behavioral task
behavioral1
Sample
e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
Errors
Reason
Remote task has failed: Machine shutdown
General
-
Target
e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe
-
Size
4.2MB
-
MD5
d985a6610213773a43584afe1107dbd9
-
SHA1
4e743e81dcb4df6e21aacd0ad2918a5b20586127
-
SHA256
e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d
-
SHA512
cb7779968bc632edd6531bae810953b8c4f12018c0a1fde483c75f074a10eb49d2824e64733c280daeabe373cdf95c2a3307e6cf91c200c0e34655657447fb07
Score
9/10
Malware Config
Signatures
-
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
pid Process 3980 bcdedit.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2704 shutdown.exe Token: SeRemoteShutdownPrivilege 2704 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3896 LogonUI.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 564 wrote to memory of 3980 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 75 PID 564 wrote to memory of 3980 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 75 PID 564 wrote to memory of 1804 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 76 PID 564 wrote to memory of 1804 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 76 PID 564 wrote to memory of 1804 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 76 PID 564 wrote to memory of 408 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 77 PID 564 wrote to memory of 408 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 77 PID 564 wrote to memory of 408 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 77 PID 564 wrote to memory of 752 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 78 PID 564 wrote to memory of 752 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 78 PID 564 wrote to memory of 752 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 78 PID 564 wrote to memory of 2704 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 80 PID 564 wrote to memory of 2704 564 e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe"C:\Users\Admin\AppData\Local\Temp\e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\windows\System32\bcdedit.exec:\windows\Sysnative\bcdedit.exe /set {current} safeboot minimal2⤵
- Modifies boot configuration data using bcdedit
PID:3980
-
-
C:\Windows\SysWOW64\shutdown.exeshutdown /r /f /t 002⤵PID:1804
-
-
\??\c:\windows\SysWOW64\shutdown.exec:\windows\SysWOW64\shutdown.exe /r /f /t 002⤵PID:408
-
-
\??\c:\windows\SysWOW64\shutdown.exec:\windows\System32\shutdown.exe /r /f /t 002⤵PID:752
-
-
\??\c:\windows\System32\shutdown.exec:\windows\Sysnative\shutdown.exe /r /f /t 002⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ad0055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3896