Analysis
-
max time kernel
87s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 20:19
Behavioral task
behavioral1
Sample
Ransomware.RedBoot.zip
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral2
Sample
Ransomware.RedBoot.zip
Resource
win10v2004-20231020-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe
Resource
win7-20231020-en
windows7-x64
Behavioral task
behavioral4
Sample
1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
out.exe
Resource
win7-20231025-en
windows7-x64
Behavioral task
behavioral6
Sample
out.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
Errors
General
-
Target
1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe
-
Size
1.2MB
-
MD5
e0340f456f76993fc047bc715dfdae6a
-
SHA1
d47f6f7e553c4bc44a2fe88c2054de901390b2d7
-
SHA256
1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887
-
SHA512
cac10c675d81630eefca49b2ac4cc83f3eb29115ee28a560db4d6c33f70bf24980e48bb48ce20375349736e3e6b23a1ca504b9367917328853fffc5539626bbc
-
SSDEEP
24576:/4GHnhIzOasqUgEOr69/BRH7dCibu+XoAX0eOTva49ttrSpt81ekHPyWe:AshdasJgEOrGBRxCihH7OO49rveMG
Malware Config
Signatures
-
Renames multiple (145) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 3 IoCs
pid Process 3824 protect.exe 1092 assembler.exe 5012 overwrite.exe -
resource yara_rule behavioral4/memory/2564-0-0x0000000000390000-0x000000000061E000-memory.dmp upx behavioral4/memory/2564-183-0x0000000000390000-0x000000000061E000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 overwrite.exe -
AutoIT Executable 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral4/files/0x0007000000022e0e-22.dat autoit_exe behavioral4/files/0x0007000000022e0e-26.dat autoit_exe behavioral4/memory/2564-183-0x0000000000390000-0x000000000061E000-memory.dmp autoit_exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\rescache\_merged\2229298842\1941909060.pri LogonUI.exe -
Modifies data under HKEY_USERS 15 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "110" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe 3824 protect.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800859736734164392 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800882826474087915 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800896020611261711 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800900418656986427 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800903717208188208 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800922408902387015 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800926806948111731 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800956493706533536 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800960891752258268 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800969687843707588 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800978483935156972 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9800987280026606100 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801008170760182365 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801021364897356401 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801034559034530709 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801048852700306348 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801100529753955161 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801103828288379734 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801104927799679829 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801137913092544691 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801146709183994075 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801147808695294174 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801178595015366658 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801181893549791291 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801184092589168701 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801212679886641263 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801219276954966429 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801231371597617586 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801240167689066970 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801244565734791638 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801248963780516290 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801252262314940923 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801273153032263936 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801276451566164281 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801281949140490536 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801300640834689407 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801308337414838624 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9801317133506289288 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 188985704548 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 12511258665968 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9835494039712 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 12738891932768 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9539141296624 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 11733869584592 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 14143346238432 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 9822609138048 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 11763934355696 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 14770411463456 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 15075354141488 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: SeTakeOwnershipPrivilege 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 0 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 412316860512 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe Token: 6937813002834471071 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2032 LogonUI.exe 2032 LogonUI.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2564 wrote to memory of 3824 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe 89 PID 2564 wrote to memory of 3824 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe 89 PID 2564 wrote to memory of 3824 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe 89 PID 2564 wrote to memory of 1092 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe 90 PID 2564 wrote to memory of 1092 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe 90 PID 2564 wrote to memory of 1092 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe 90 PID 2564 wrote to memory of 5012 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe 93 PID 2564 wrote to memory of 5012 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe 93 PID 2564 wrote to memory of 5012 2564 1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe"C:\Users\Admin\AppData\Local\Temp\1001a8c7f33185217e6e1bdbb8dba9780d475da944684fb4bf1fc04809525887.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Users\Admin\10385113\protect.exe"C:\Users\Admin\10385113\protect.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3824
-
-
C:\Users\Admin\10385113\assembler.exe"C:\Users\Admin\10385113\assembler.exe" -f bin "C:\Users\Admin\10385113\boot.asm" -o "C:\Users\Admin\10385113\boot.bin"2⤵
- Executes dropped EXE
PID:1092
-
-
C:\Users\Admin\10385113\overwrite.exe"C:\Users\Admin\10385113\overwrite.exe" "C:\Users\Admin\10385113\boot.bin"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:5012
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39a1855 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2032
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\57865ea4a6ff46769b3f54a38b27b7cc /t 0 /p 38721⤵PID:1980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
589KB
MD57e3cea1f686207563c8369f64ea28e5b
SHA1a1736fd61555841396b0406d5c9ca55c4b6cdf41
SHA2562a5305369edb9c2d7354b2f210e91129e4b8c546b0adf883951ea7bf7ee0f2b2
SHA5124629bc32094bdb030e6c9be247068e7295599203284cb95921c98fcbe3ac60286670be7e5ee9f0374a4017286c7af9db211bd831e3ea871d31a509d7bbc1d6a3
-
Filesize
589KB
MD57e3cea1f686207563c8369f64ea28e5b
SHA1a1736fd61555841396b0406d5c9ca55c4b6cdf41
SHA2562a5305369edb9c2d7354b2f210e91129e4b8c546b0adf883951ea7bf7ee0f2b2
SHA5124629bc32094bdb030e6c9be247068e7295599203284cb95921c98fcbe3ac60286670be7e5ee9f0374a4017286c7af9db211bd831e3ea871d31a509d7bbc1d6a3
-
Filesize
825B
MD5def1219cfb1c0a899e5c4ea32fe29f70
SHA188aedde59832576480dfc7cd3ee6f54a132588a8
SHA25691e74c438099172b057bedf693d877bd08677d5f2173763986be4974c0970581
SHA5121e735d588cb1bb42324eaff1b9190ec6a8254f419d1ba4a13d03716ff5c102a335532b573a5befb08da90586e5670617066564ef9872f8c415b9a480836df423
-
Filesize
512B
MD590053233e561c8bf7a7b14eda0fa0e84
SHA116a7138387f7a3366b7da350c598f71de3e1cde2
SHA256a760d8bc77ad8c0c839d4ef162ce44d5897af6fa84e0cc05ecc0747759ea76c2
SHA51263fda509cd02fd9d1374435f95515bc74f1ca8a9650b87d2299f8eee3a1c5a41b1cb8a4e1360c75f876f1dae193fdf4a96eba244683308f34d64d7ce37af2bb4
-
Filesize
288KB
MD5bc160318a6e8dadb664408fb539cd04b
SHA14b5eb324eebe3f84e623179a8e2c3743ccf32763
SHA256f2bc5886b0f189976a367a69da8745bf66842f9bba89f8d208790db3dad0c7d2
SHA51251bc090f2821c57d94cfe4399b1f372a68d2811ea0b87d1ac1d6cf8ae39b167038ac21c471b168f1d19c6b213762024abb7e9e5ca311b246b46af0888289e46c
-
Filesize
288KB
MD5bc160318a6e8dadb664408fb539cd04b
SHA14b5eb324eebe3f84e623179a8e2c3743ccf32763
SHA256f2bc5886b0f189976a367a69da8745bf66842f9bba89f8d208790db3dad0c7d2
SHA51251bc090f2821c57d94cfe4399b1f372a68d2811ea0b87d1ac1d6cf8ae39b167038ac21c471b168f1d19c6b213762024abb7e9e5ca311b246b46af0888289e46c
-
Filesize
837KB
MD5fd414666a5b2122c3d9e3e380cf225ed
SHA1de139747b42a807efa8a2dcc1a8304f9a29b862d
SHA256e61a8382f7293e40cb993ddcbcaa53a4e5f07a3d6b6a1bfe5377a1a74a8dcac6
SHA5129ab2163d7deff29c202ed88dba36d5b28f6c67e647a0cadb3d03cc725796e19e5f298c04b1c8523d1d1ee4307e1a5d6f8156fa4021627d6ca1bbd0830695ae05
-
Filesize
837KB
MD5fd414666a5b2122c3d9e3e380cf225ed
SHA1de139747b42a807efa8a2dcc1a8304f9a29b862d
SHA256e61a8382f7293e40cb993ddcbcaa53a4e5f07a3d6b6a1bfe5377a1a74a8dcac6
SHA5129ab2163d7deff29c202ed88dba36d5b28f6c67e647a0cadb3d03cc725796e19e5f298c04b1c8523d1d1ee4307e1a5d6f8156fa4021627d6ca1bbd0830695ae05