a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b

Reason

Machine shutdown

General

Target

a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe
Size

336KB
MD5

440772a59bcd96f082729fd01230e0b8
SHA1

51466aa487c81a3b14dce84d660a800b352e35ac
SHA256

a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b
SHA512

518edb76aaac714137c295d8fcfaf7c2d6b4f743c67416f74c5c5fe57997396d97d2f94729655ccfbdb4e47a8e5a856b2822524e044dd8bb9749b9fb2c36c566
SSDEEP

6144:pBr9gkw1fhh/5ZnLRf3JUMKxKSqAYGOI3YWAE1Qek4Skg+Y8a9W+tQclx:jr9xsxNLR2MKIg/6ULSk7YPJt1T

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid	process
1920	bcdedit.exe
916	bcdedit.exe
1472	bcdedit.exe
900	bcdedit.exe
560	bcdedit.exe
1820	bcdedit.exe
1500	bcdedit.exe
1048	bcdedit.exe
324	bcdedit.exe
1752	bcdedit.exe

Drops file in Drivers directory 1 IoCs

Processes:

syshost.exe

description ioc process

File created C:\Windows\system32\drivers\6c5f6f.sys syshost.exe
Executes dropped EXE 1 IoCs

Processes:

syshost.exe

pid process

1756 syshost.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

520 cmd.exe

description	ioc	process
File created	C:\Windows\system32\drivers\6c5f6f.sys	syshost.exe

pid	process
1756	syshost.exe

pid	process
520	cmd.exe

Drops file in Windows directory 3 IoCs

Processes:

a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exesyshost.exe

description	ioc	process
File created	C:\Windows\Installer\{B05CE45C-8C26-A112-FC88-587FDA17AED1}\syshost.exe	a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe
File opened for modification	C:\Windows\Installer\{B05CE45C-8C26-A112-FC88-587FDA17AED1}\syshost.exe	a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe
File opened for modification	C:\Windows\Installer\{B05CE45C-8C26-A112-FC88-587FDA17AED1}\syshost.exe.tmp	syshost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious behavior: RenamesItself 1 IoCs

Processes:

a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe

pid process

1368 a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

syshost.exe

description pid process

Token: SeShutdownPrivilege 1756 syshost.exe

pid	process
460

pid	process
1368	a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe

description	pid	process
Token: SeShutdownPrivilege	1756	syshost.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exesyshost.exe

description	pid	process	target process
PID 1368 wrote to memory of 520	1368	a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe	cmd.exe
PID 1368 wrote to memory of 520	1368	a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe	cmd.exe
PID 1368 wrote to memory of 520	1368	a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe	cmd.exe
PID 1368 wrote to memory of 520	1368	a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe	cmd.exe
PID 1756 wrote to memory of 1920	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1920	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1920	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1920	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 916	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 916	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 916	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 916	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1472	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1472	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1472	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1472	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 900	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 900	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 900	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 900	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1820	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1820	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1820	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1820	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 560	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 560	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 560	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 560	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1500	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1500	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1500	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1500	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1048	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1048	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1048	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1048	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 324	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 324	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 324	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 324	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1752	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1752	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1752	1756	syshost.exe	bcdedit.exe
PID 1756 wrote to memory of 1752	1756	syshost.exe	bcdedit.exe

C:\Users\Admin\AppData\Local\Temp\a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe
"C:\Users\Admin\AppData\Local\Temp\a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1368

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\e2bd0cd8.tmp"
2⤵
- Deletes itself
PID:520

C:\Windows\Installer\{B05CE45C-8C26-A112-FC88-587FDA17AED1}\syshost.exe
"C:\Windows\Installer\{B05CE45C-8C26-A112-FC88-587FDA17AED1}\syshost.exe" /service
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1756

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1920

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:916

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1472

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:900

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:560

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1820

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1500

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1048

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:324

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1752

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1208

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2016

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\{B05CE45C-8C26-A112-FC88-587FDA17AED1}\syshost.exe
Filesize
336KB

MD5
440772a59bcd96f082729fd01230e0b8

SHA1
51466aa487c81a3b14dce84d660a800b352e35ac

SHA256
a7843248abb53e4c5d331546fa3d268b261c7e82f83297c08364d3770cba333b

SHA512
518edb76aaac714137c295d8fcfaf7c2d6b4f743c67416f74c5c5fe57997396d97d2f94729655ccfbdb4e47a8e5a856b2822524e044dd8bb9749b9fb2c36c566

Download Submit
memory/324-73-0x0000000000000000-mapping.dmp

Download
memory/520-60-0x0000000000000000-mapping.dmp

Download
memory/560-70-0x0000000000000000-mapping.dmp

Download
memory/900-68-0x0000000000000000-mapping.dmp

Download
memory/916-66-0x0000000000000000-mapping.dmp

Download
memory/1048-72-0x0000000000000000-mapping.dmp

Download
memory/1208-77-0x000007FEFC091000-0x000007FEFC093000-memory.dmp

Filesize
8KB

Download
memory/1368-57-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1368-61-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1368-55-0x0000000001DC0000-0x0000000001EC0000-memory.dmp

Filesize
1024KB

Download
memory/1368-56-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1368-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1472-67-0x0000000000000000-mapping.dmp

Download
memory/1500-71-0x0000000000000000-mapping.dmp

Download
memory/1752-74-0x0000000000000000-mapping.dmp

Download
memory/1756-63-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1756-64-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/1756-75-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/1756-76-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/1756-62-0x0000000000B30000-0x0000000000C30000-memory.dmp

Filesize
1024KB

Download
memory/1820-69-0x0000000000000000-mapping.dmp

Download
memory/1920-65-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads