f524a5c25ecb3613caf42b3f6e420bd74413460dbb452bc68bf41fd6d9b0f17a

Reason

Machine shutdown

General

Target

f524a5c25ecb3613caf42b3f6e420bd74413460dbb452bc68bf41fd6d9b0f17a.exe
Size

20KB
MD5

046eea7ab9f96e72525abbbab0d782d0
SHA1

a1485ad94e78cb486085964e2bb7a4da1345fabb
SHA256

f524a5c25ecb3613caf42b3f6e420bd74413460dbb452bc68bf41fd6d9b0f17a
SHA512

ef53748b658afb23ff0cea3f42ba7c0842523ba03ab69b53ce5f16f7c4334045d6d59a436102f82240d62e13fd8ced649eb0a7bedc2b6a74bd8fb1a37573145e
SSDEEP

192:qcqLNr7kzuoXZBgQUjxM9DLlQIy66CdUvBS9cJlHmTAZbebAtMGV18ggh3FUF:acRZBgfwDZQIy6BWvQYlHmzTGf8r1UF

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	f524a5c25ecb3613caf42b3f6e420bd74413460dbb452bc68bf41fd6d9b0f17a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "174"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings	f524a5c25ecb3613caf42b3f6e420bd74413460dbb452bc68bf41fd6d9b0f17a.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	212	shutdown.exe
Token: SeRemoteShutdownPrivilege	212	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3896	LogonUI.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 1532	2064	f524a5c25ecb3613caf42b3f6e420bd74413460dbb452bc68bf41fd6d9b0f17a.exe	79
PID 2064 wrote to memory of 1532	2064	f524a5c25ecb3613caf42b3f6e420bd74413460dbb452bc68bf41fd6d9b0f17a.exe	79
PID 2064 wrote to memory of 1532	2064	f524a5c25ecb3613caf42b3f6e420bd74413460dbb452bc68bf41fd6d9b0f17a.exe	79
PID 1532 wrote to memory of 4428	1532	WScript.exe	80
PID 1532 wrote to memory of 4428	1532	WScript.exe	80
PID 1532 wrote to memory of 4428	1532	WScript.exe	80
PID 4428 wrote to memory of 212	4428	cmd.exe	82
PID 4428 wrote to memory of 212	4428	cmd.exe	82
PID 4428 wrote to memory of 212	4428	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\f524a5c25ecb3613caf42b3f6e420bd74413460dbb452bc68bf41fd6d9b0f17a.exe
"C:\Users\Admin\AppData\Local\Temp\f524a5c25ecb3613caf42b3f6e420bd74413460dbb452bc68bf41fd6d9b0f17a.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\e5695fb\e5695fb1.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c shutdown -r -t 60 -c "ËµÎÒÊÇÖí£¬²»ËµÎÒÊÇÖí¾ÍÒ»·ÖÖÓ¹ØÄã»ú£¬²»ÐÅ£¬ÊÔÊÔ¡¤¡¤¡¤"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4428
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -r -t 60 -c "ËµÎÒÊÇÖí£¬²»ËµÎÒÊÇÖí¾ÍÒ»·ÖÖÓ¹ØÄã»ú£¬²»ÐÅ£¬ÊÔÊÔ¡¤¡¤¡¤"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:212

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39df855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\e5695fb\e5695fb1.vbs

Filesize
607B

MD5
ff5a6d2cc4be90f066507efa0f9ea984

SHA1
d257954d0cd4e8168063f222e1e03c01e4a545c4

SHA256
2cc1b4606fe811eb6a5c869c9b1841cb2451ede59b8de23e187f6670c293a281

SHA512
95e7c1bfd140801e9c871ed4fe5774cf3fa4f99e1efb2cd44f4999064706ba67ab6b4130e75c713d4e5bd37f3d8193b3f40710977039e108aef62dda982b2875

Download Submit
memory/212-135-0x0000000000000000-mapping.dmp

Download
memory/1532-132-0x0000000000000000-mapping.dmp

Download
memory/4428-134-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors