8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66

Analysis

max time kernel
16s
max time network
23s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2022, 17:02

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe
Size

34KB
MD5

55f6ce436f1bbae9093e8fcae2efc155
SHA1

47001263656fc8c97d137a0339c25b9026671a9c
SHA256

8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66
SHA512

eba7ee0890f71a9e623ab25c8d6173b4abf848d04bdab962c33282bfd29526fda0079ddb67481963e5a1150780e330e0dfb39e783f458cc57b05bf5d44c6585d
SSDEEP

768:v/O832QhUNI3yIFf1MnQnT/8TF7oyepclS:v/O832Q6cpFRnD8TFYclS

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "223"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	744	shutdown.exe
Token: SeRemoteShutdownPrivilege	744	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2640	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2572	4396	8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe	84
PID 4396 wrote to memory of 2572	4396	8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe	84
PID 4396 wrote to memory of 2572	4396	8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe	84
PID 2572 wrote to memory of 744	2572	cmd.exe	87
PID 2572 wrote to memory of 744	2572	cmd.exe	87
PID 2572 wrote to memory of 744	2572	cmd.exe	87

C:\Users\Admin\AppData\Local\Temp\8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe
"C:\Users\Admin\AppData\Local\Temp\8aed902810cb15d00040b846d72ffaf96979527d4b756c579d792ac8583caf66.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Se.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r -t 1
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:744

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ec855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Se.bat

Filesize
96B

MD5
b67814c71e18a43252cd56a14ecd44d8

SHA1
9f6a4ffe15d54d6c8073257e9d6e4d4e763ea21e

SHA256
31836bce8cc9ab7b6138af0cfdcbc2ee5197ad09eb2793c9fadca19aa8555012

SHA512
f76ec2990dc2b711b7aae301b318c33f05e6df8b2f50e718094299c79f20ee9ba9c2f806f7a24587971a0d6ba084c70e635a100c7cf59a3b05c7e4bef614cf5f

Download Submit