snatch | 36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4

Reason

Machine shutdown

General

Target

36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe
Size

4.2MB
MD5

32de66a467db22cf0f5b65d1a9f4e19c
SHA1

cdb5c200cba7da3f6e80e868ef7df380ac1259c2
SHA256

36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4
SHA512

af200cc334c05e5fe0df1d4c76b5ce469d034c0d62288d207b6bb6562579e07dc4510e4bfc4b726cf1a9f82ae8cb69c4630e981f23d05fb85e3be842a34244f1
SSDEEP

49152:fgZNPqLGVfMmq1d1MRGM8Fvg9fR5HMXF9W9HrAbluBUMNk+cqG2UtBpStPvC/9f+:fgXsMfql+9G9+B+tBpEPvCF

Score

10^/10

snatch evasion ransomware upx

Malware Config

Signatures

Detecting the common Go functions and variables names used by Snatch ransomware 2 IoCs

resource	yara_rule
behavioral2/memory/2368-133-0x0000000000400000-0x000000000082C000-memory.dmp	family_snatch
behavioral2/memory/2368-134-0x0000000000400000-0x000000000082C000-memory.dmp	family_snatch

Snatch Ransomware
Ransomware family generally distributed through RDP bruteforce attacks.
ransomware snatch

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4812	bcdedit.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2368-133-0x0000000000400000-0x000000000082C000-memory.dmp	upx
behavioral2/memory/2368-134-0x0000000000400000-0x000000000082C000-memory.dmp	upx

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "15"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3656	shutdown.exe
Token: SeRemoteShutdownPrivilege	3656	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3916	LogonUI.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 4812	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	84
PID 2368 wrote to memory of 4812	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	84
PID 2368 wrote to memory of 1988	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	85
PID 2368 wrote to memory of 1988	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	85
PID 2368 wrote to memory of 1988	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	85
PID 2368 wrote to memory of 2620	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	86
PID 2368 wrote to memory of 2620	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	86
PID 2368 wrote to memory of 2620	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	86
PID 2368 wrote to memory of 1356	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	87
PID 2368 wrote to memory of 1356	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	87
PID 2368 wrote to memory of 1356	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	87
PID 2368 wrote to memory of 3656	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	88
PID 2368 wrote to memory of 3656	2368	36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe	88

C:\Users\Admin\AppData\Local\Temp\36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe
"C:\Users\Admin\AppData\Local\Temp\36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2368
- \??\c:\windows\system32\bcdedit.exe
  c:\windows\Sysnative\bcdedit.exe /set {current} safeboot minimal
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4812
- C:\Windows\SysWOW64\shutdown.exe
  shutdown /r /f /t 00
  2⤵
  PID:1988
- \??\c:\windows\SysWOW64\shutdown.exe
  c:\windows\SysWOW64\shutdown.exe /r /f /t 00
  2⤵
  PID:2620
- \??\c:\windows\SysWOW64\shutdown.exe
  c:\windows\System32\shutdown.exe /r /f /t 00
  2⤵
  PID:1356
- \??\c:\windows\system32\shutdown.exe
  c:\windows\Sysnative\shutdown.exe /r /f /t 00
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3656

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3998055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-133-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/2368-134-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download

Analysis

Sharing

Errors