f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812

Reason

Machine shutdown

General

Target

f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe
Size

216KB
MD5

88f9c81bf69cde243fa55d8b77b07dd2
SHA1

eee450f5fec2242d0d1057bd8e4d1f7ab2f11a6a
SHA256

f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812
SHA512

eeb6461292438f6d2ed90713d282c1535bb7c13ff2d085861b34dd0e3d45fdc8e07f0676b3f52bd76eea8392027ee88412cf649735084a7115c6ae6156e426dc
SSDEEP

6144:L63B7PRp/6XP90OzsKP58jeLq4oYXskCTMC1j:WR7pU/mqBPOMzStJ

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid	process
1076	bcdedit.exe
1124	bcdedit.exe
1712	bcdedit.exe
836	bcdedit.exe
2028	bcdedit.exe
1700	bcdedit.exe
1708	bcdedit.exe
1180	bcdedit.exe
1588	bcdedit.exe
608	bcdedit.exe

Drops file in Drivers directory 1 IoCs

Processes:

syshost.exe

description ioc process

File created C:\Windows\system32\drivers\6c1269.sys syshost.exe
Executes dropped EXE 1 IoCs

Processes:

syshost.exe

pid process

916 syshost.exe
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1464 cmd.exe

description	ioc	process
File created	C:\Windows\system32\drivers\6c1269.sys	syshost.exe

pid	process
916	syshost.exe

pid	process
1464	cmd.exe

Drops file in Windows directory 3 IoCs

Processes:

f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exesyshost.exe

description	ioc	process
File created	C:\Windows\Installer\{41296F46-7A29-BA3F-6404-8C0C3CB711C6}\syshost.exe	f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe
File opened for modification	C:\Windows\Installer\{41296F46-7A29-BA3F-6404-8C0C3CB711C6}\syshost.exe	f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe
File opened for modification	C:\Windows\Installer\{41296F46-7A29-BA3F-6404-8C0C3CB711C6}\syshost.exe.tmp	syshost.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

464
Suspicious behavior: RenamesItself 1 IoCs

Processes:

f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe

pid process

1108 f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

syshost.exe

description pid process

Token: SeShutdownPrivilege 916 syshost.exe

pid	process
464

pid	process
1108	f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe

description	pid	process
Token: SeShutdownPrivilege	916	syshost.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exesyshost.exe

description	pid	process	target process
PID 1108 wrote to memory of 1464	1108	f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe	cmd.exe
PID 1108 wrote to memory of 1464	1108	f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe	cmd.exe
PID 1108 wrote to memory of 1464	1108	f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe	cmd.exe
PID 1108 wrote to memory of 1464	1108	f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe	cmd.exe
PID 916 wrote to memory of 1076	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1076	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1076	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1076	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1124	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1124	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1124	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1124	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1712	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1712	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1712	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1712	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 836	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 836	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 836	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 836	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 2028	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 2028	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 2028	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 2028	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1700	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1700	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1700	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1700	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1708	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1708	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1708	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1708	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1180	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1180	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1180	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1180	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1588	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1588	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1588	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 1588	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 608	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 608	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 608	916	syshost.exe	bcdedit.exe
PID 916 wrote to memory of 608	916	syshost.exe	bcdedit.exe

C:\Users\Admin\AppData\Local\Temp\f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe
"C:\Users\Admin\AppData\Local\Temp\f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1108

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\826dbc47.tmp"
2⤵
- Deletes itself
PID:1464

C:\Windows\Installer\{41296F46-7A29-BA3F-6404-8C0C3CB711C6}\syshost.exe
"C:\Windows\Installer\{41296F46-7A29-BA3F-6404-8C0C3CB711C6}\syshost.exe" /service
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1076

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1124

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1712

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:836

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:2028

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1700

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1708

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1180

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:1588

C:\Windows\system32\bcdedit.exe
bcdedit.exe -set TESTSIGNING ON
2⤵
- Modifies boot configuration data using bcdedit
PID:608

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1044

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1900

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Installer\{41296F46-7A29-BA3F-6404-8C0C3CB711C6}\syshost.exe
Filesize
216KB

MD5
88f9c81bf69cde243fa55d8b77b07dd2

SHA1
eee450f5fec2242d0d1057bd8e4d1f7ab2f11a6a

SHA256
f7dc6cfcc93ad200a615e4b0b1951e7ab159636eb48d8f19874dc1698e532812

SHA512
eeb6461292438f6d2ed90713d282c1535bb7c13ff2d085861b34dd0e3d45fdc8e07f0676b3f52bd76eea8392027ee88412cf649735084a7115c6ae6156e426dc

Download Submit
memory/608-71-0x0000000000000000-mapping.dmp

Download
memory/836-65-0x0000000000000000-mapping.dmp

Download
memory/916-72-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/916-73-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/916-74-0x0000000000220000-0x0000000000226000-memory.dmp

Filesize
24KB

Download
memory/916-75-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1044-76-0x000007FEFBF71000-0x000007FEFBF73000-memory.dmp

Filesize
8KB

Download
memory/1076-61-0x0000000000000000-mapping.dmp

Download
memory/1108-62-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1108-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

Filesize
8KB

Download
memory/1108-56-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1108-57-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/1108-55-0x00000000002A0000-0x00000000003A0000-memory.dmp

Filesize
1024KB

Download
memory/1124-63-0x0000000000000000-mapping.dmp

Download
memory/1180-69-0x0000000000000000-mapping.dmp

Download
memory/1464-60-0x0000000000000000-mapping.dmp

Download
memory/1588-70-0x0000000000000000-mapping.dmp

Download
memory/1700-67-0x0000000000000000-mapping.dmp

Download
memory/1708-68-0x0000000000000000-mapping.dmp

Download
memory/1712-64-0x0000000000000000-mapping.dmp

Download
memory/2028-66-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads