e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d

Reason

Remote task has failed: Machine shutdown

General

Target

e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe
Size

4.2MB
MD5

d985a6610213773a43584afe1107dbd9
SHA1

4e743e81dcb4df6e21aacd0ad2918a5b20586127
SHA256

e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d
SHA512

cb7779968bc632edd6531bae810953b8c4f12018c0a1fde483c75f074a10eb49d2824e64733c280daeabe373cdf95c2a3307e6cf91c200c0e34655657447fb07

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exe

pid process

3980 bcdedit.exe

pid	process
3980	bcdedit.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

shutdown.exe

description pid process

Token: SeShutdownPrivilege 2704 shutdown.exe
Token: SeRemoteShutdownPrivilege 2704 shutdown.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

3896 LogonUI.exe

description	pid	process
Token: SeShutdownPrivilege	2704	shutdown.exe
Token: SeRemoteShutdownPrivilege	2704	shutdown.exe

pid	process
3896	LogonUI.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe

description	pid	process	target process
PID 564 wrote to memory of 3980	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	bcdedit.exe
PID 564 wrote to memory of 3980	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	bcdedit.exe
PID 564 wrote to memory of 1804	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 564 wrote to memory of 1804	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 564 wrote to memory of 1804	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 564 wrote to memory of 408	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 564 wrote to memory of 408	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 564 wrote to memory of 408	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 564 wrote to memory of 752	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 564 wrote to memory of 752	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 564 wrote to memory of 752	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 564 wrote to memory of 2704	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe
PID 564 wrote to memory of 2704	564	e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe	shutdown.exe

C:\Users\Admin\AppData\Local\Temp\e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe
"C:\Users\Admin\AppData\Local\Temp\e8931967ed5a4d4e0d7787054cddee8911a7740b80373840b276f14e36bda57d.sample.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:564

\??\c:\windows\System32\bcdedit.exe
c:\windows\Sysnative\bcdedit.exe /set {current} safeboot minimal
2⤵
- Modifies boot configuration data using bcdedit
PID:3980

C:\Windows\SysWOW64\shutdown.exe
shutdown /r /f /t 00
2⤵
PID:1804

\??\c:\windows\SysWOW64\shutdown.exe
c:\windows\SysWOW64\shutdown.exe /r /f /t 00
2⤵
PID:408

\??\c:\windows\SysWOW64\shutdown.exe
c:\windows\System32\shutdown.exe /r /f /t 00
2⤵
PID:752

\??\c:\windows\System32\shutdown.exe
c:\windows\Sysnative\shutdown.exe /r /f /t 00
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad0055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3896

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/408-116-0x0000000000000000-mapping.dmp

Download
memory/752-117-0x0000000000000000-mapping.dmp

Download
memory/1804-115-0x0000000000000000-mapping.dmp

Download
memory/2704-118-0x0000000000000000-mapping.dmp

Download
memory/3980-114-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors