6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb

Reason

Machine shutdown

General

Target

6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Size

2.0MB
MD5

208163a38ece0c2ca35ccdc28b04bd3b
SHA1

2d969440afd52cd1d94a87822b885f4ea447b36e
SHA256

6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb
SHA512

f7ad0d180c3b9bbaff0c8c3d27ac0278f20479fc2b6f5d3d49fdd9d82601d96e4fa02556243843d2cec649fac7944e7138891f4d87aaae9fe9579e70022bacb1
SSDEEP

49152:agkESlEQbdmNTs36OtsJ0MH9awJOusluKOY:agcEWmNAK2E9a9usl

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exe

pid process

1056 bcdedit.exe

pid	process
1056	bcdedit.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe

pid	process
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe

description	pid	process
Token: SeDebugPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: SeIncBasePriorityPrivilege	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
Token: 33	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.execmd.exe

description	pid	process	target process
PID 1700 wrote to memory of 1728	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe	cmd.exe
PID 1700 wrote to memory of 1728	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe	cmd.exe
PID 1700 wrote to memory of 1728	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe	cmd.exe
PID 1728 wrote to memory of 1056	1728	cmd.exe	bcdedit.exe
PID 1728 wrote to memory of 1056	1728	cmd.exe	bcdedit.exe
PID 1728 wrote to memory of 1056	1728	cmd.exe	bcdedit.exe
PID 1700 wrote to memory of 1464	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe	shutdown.exe
PID 1700 wrote to memory of 1464	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe	shutdown.exe
PID 1700 wrote to memory of 1464	1700	6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe	shutdown.exe

C:\Users\Admin\AppData\Local\Temp\6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe
"C:\Users\Admin\AppData\Local\Temp\6849bf7b141ad9ee2bf5aaa7ebd0ccbbf97105e06d9ef333a48b540b6de13dcb.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1700

C:\Windows\system32\cmd.exe
cmd.exe /c bcdedit /set safeboot network
2⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\system32\bcdedit.exe
bcdedit /set safeboot network
3⤵
- Modifies boot configuration data using bcdedit
PID:1056

C:\Windows\system32\shutdown.exe
shutdown -r -t 00
2⤵
PID:1464

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1d8
1⤵
PID:556

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1528

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:732

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1056-60-0x0000000000000000-mapping.dmp

Download
memory/1464-61-0x0000000000000000-mapping.dmp

Download
memory/1528-63-0x000007FEFBF61000-0x000007FEFBF63000-memory.dmp

Filesize
8KB

Download
memory/1700-54-0x00000000002B0000-0x00000000004AE000-memory.dmp

Filesize
2.0MB

Download
memory/1700-55-0x000000001B4D0000-0x000000001B696000-memory.dmp

Filesize
1.8MB

Download
memory/1700-56-0x000000001B8B0000-0x000000001BA84000-memory.dmp

Filesize
1.8MB

Download
memory/1700-57-0x000000001BD90000-0x000000001BFB0000-memory.dmp

Filesize
2.1MB

Download
memory/1700-58-0x000000001AF36000-0x000000001AF55000-memory.dmp

Filesize
124KB

Download
memory/1700-62-0x000000001AF36000-0x000000001AF55000-memory.dmp

Filesize
124KB

Download
memory/1728-59-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads