0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb

Reason

Machine shutdown

General

Target

0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe
Size

4.0MB
MD5

29738dd9b52dcd61cd791b6d805929c1
SHA1

b226a60f03c7036f6bcbce400ad40ebe7f527925
SHA256

0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb
SHA512

fcf8b789a36f90414034a131c6ba872a547d03025fd29aaf48779ea154aee02def7234f4c17dcec5b0f9bcd26cdce34b257979872c0b44d1c4bcafa9a42ac65b
SSDEEP

49152:1gZNP3LGVfMmq1d1MRGM8Fvg9fR5xMXF9WzHrAbluBUMNk+cqG2UtBpStPvC/9fu:1gXDMfql+929+B+tBpEPvCF

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exe

pid process

2696 bcdedit.exe

pid	process
2696	bcdedit.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "87"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

shutdown.exeshutdown.exeshutdown.exeshutdown.exe

description	pid	process
Token: SeShutdownPrivilege	772	shutdown.exe
Token: SeRemoteShutdownPrivilege	772	shutdown.exe
Token: SeShutdownPrivilege	1712	shutdown.exe
Token: SeRemoteShutdownPrivilege	1712	shutdown.exe
Token: SeShutdownPrivilege	2564	shutdown.exe
Token: SeRemoteShutdownPrivilege	2564	shutdown.exe
Token: SeShutdownPrivilege	4436	shutdown.exe
Token: SeRemoteShutdownPrivilege	4436	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

1604 LogonUI.exe

pid	process
1604	LogonUI.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe

description	pid	process	target process
PID 2304 wrote to memory of 2696	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	bcdedit.exe
PID 2304 wrote to memory of 2696	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	bcdedit.exe
PID 2304 wrote to memory of 2564	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	shutdown.exe
PID 2304 wrote to memory of 2564	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	shutdown.exe
PID 2304 wrote to memory of 2564	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	shutdown.exe
PID 2304 wrote to memory of 4436	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	shutdown.exe
PID 2304 wrote to memory of 4436	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	shutdown.exe
PID 2304 wrote to memory of 4436	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	shutdown.exe
PID 2304 wrote to memory of 1712	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	shutdown.exe
PID 2304 wrote to memory of 1712	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	shutdown.exe
PID 2304 wrote to memory of 1712	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	shutdown.exe
PID 2304 wrote to memory of 772	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	shutdown.exe
PID 2304 wrote to memory of 772	2304	0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe	shutdown.exe

C:\Users\Admin\AppData\Local\Temp\0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe
"C:\Users\Admin\AppData\Local\Temp\0ce4c4af321ff02928aacf105f03dead87e85003080586615755f278770f5adb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2304
- \??\c:\windows\system32\bcdedit.exe
  c:\windows\Sysnative\bcdedit.exe /set {current} safeboot minimal
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2696
- C:\Windows\SysWOW64\shutdown.exe
  shutdown /r /f /t 00
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2564
- \??\c:\windows\SysWOW64\shutdown.exe
  c:\windows\SysWOW64\shutdown.exe /r /f /t 00
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- \??\c:\windows\SysWOW64\shutdown.exe
  c:\windows\System32\shutdown.exe /r /f /t 00
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- \??\c:\windows\system32\shutdown.exe
  c:\windows\Sysnative\shutdown.exe /r /f /t 00
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:772

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39da855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads