5c20e089c366623c7be4d175355ef07c5253cc0418e313bb3ae08e0fdcf80642

Analysis

max time kernel
25s
max time network
26s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 01:37

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

1.exe
Size

271KB
MD5

e3a6f83b5ef09c3911f9ca672e062d39
SHA1

027ca2c3693bcd14738d114efca5340fce93bf6e
SHA256

961304fdabe28cded7360df3e0415b727d7afd0bbe2d9e2ffc279e3e64da3da3
SHA512

74a9c8edd0599f88d4a0406f51c7c9775e74b7307e3c6fe1a8e3789794790425583d47d2869f5150966403a3a956db0a82b7d03d8488a75d7e9a0769fde17432
SSDEEP

6144:Me+PFF02Uc1jijsLE04OyI8Nwa7h1QBzqNwoD3AI:yXxU8nI0VyPNwg1gQ3L

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2716	bcdedit.exe
2792	bcdedit.exe
2648	bcdedit.exe
2560	bcdedit.exe
2708	bcdedit.exe
2236	bcdedit.exe
2808	bcdedit.exe
2984	bcdedit.exe
2740	bcdedit.exe
2736	bcdedit.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\f7666de.sys	syshost.exe

Deletes itself 1 IoCs

pid	Process
2432	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2464	syshost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{C219EC74-5D51-3F5C-BE6E-6B7B9D6F738F}\syshost.exe.tmp	syshost.exe
File created	C:\Windows\Installer\{C219EC74-5D51-3F5C-BE6E-6B7B9D6F738F}\syshost.exe	1.exe
File opened for modification	C:\Windows\Installer\{C219EC74-5D51-3F5C-BE6E-6B7B9D6F738F}\syshost.exe	1.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2044	1.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2464	syshost.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2716	2464	syshost.exe	30
PID 2464 wrote to memory of 2716	2464	syshost.exe	30
PID 2464 wrote to memory of 2716	2464	syshost.exe	30
PID 2464 wrote to memory of 2716	2464	syshost.exe	30
PID 2464 wrote to memory of 2736	2464	syshost.exe	49
PID 2464 wrote to memory of 2736	2464	syshost.exe	49
PID 2464 wrote to memory of 2736	2464	syshost.exe	49
PID 2464 wrote to memory of 2736	2464	syshost.exe	49
PID 2464 wrote to memory of 2740	2464	syshost.exe	48
PID 2464 wrote to memory of 2740	2464	syshost.exe	48
PID 2464 wrote to memory of 2740	2464	syshost.exe	48
PID 2464 wrote to memory of 2740	2464	syshost.exe	48
PID 2464 wrote to memory of 2984	2464	syshost.exe	45
PID 2464 wrote to memory of 2984	2464	syshost.exe	45
PID 2464 wrote to memory of 2984	2464	syshost.exe	45
PID 2464 wrote to memory of 2984	2464	syshost.exe	45
PID 2464 wrote to memory of 2648	2464	syshost.exe	33
PID 2464 wrote to memory of 2648	2464	syshost.exe	33
PID 2464 wrote to memory of 2648	2464	syshost.exe	33
PID 2464 wrote to memory of 2648	2464	syshost.exe	33
PID 2464 wrote to memory of 2792	2464	syshost.exe	32
PID 2464 wrote to memory of 2792	2464	syshost.exe	32
PID 2464 wrote to memory of 2792	2464	syshost.exe	32
PID 2464 wrote to memory of 2792	2464	syshost.exe	32
PID 2464 wrote to memory of 2808	2464	syshost.exe	44
PID 2464 wrote to memory of 2808	2464	syshost.exe	44
PID 2464 wrote to memory of 2808	2464	syshost.exe	44
PID 2464 wrote to memory of 2808	2464	syshost.exe	44
PID 2464 wrote to memory of 2236	2464	syshost.exe	43
PID 2464 wrote to memory of 2236	2464	syshost.exe	43
PID 2464 wrote to memory of 2236	2464	syshost.exe	43
PID 2464 wrote to memory of 2236	2464	syshost.exe	43
PID 2464 wrote to memory of 2708	2464	syshost.exe	42
PID 2464 wrote to memory of 2708	2464	syshost.exe	42
PID 2464 wrote to memory of 2708	2464	syshost.exe	42
PID 2464 wrote to memory of 2708	2464	syshost.exe	42
PID 2464 wrote to memory of 2560	2464	syshost.exe	35
PID 2464 wrote to memory of 2560	2464	syshost.exe	35
PID 2464 wrote to memory of 2560	2464	syshost.exe	35
PID 2464 wrote to memory of 2560	2464	syshost.exe	35
PID 2044 wrote to memory of 2432	2044	1.exe	29
PID 2044 wrote to memory of 2432	2044	1.exe	29
PID 2044 wrote to memory of 2432	2044	1.exe	29
PID 2044 wrote to memory of 2432	2044	1.exe	29

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /C del /Q /F "C:\Users\Admin\AppData\Local\Temp\86871354.tmp"
  2⤵
  - Deletes itself
  PID:2432

C:\Windows\Installer\{C219EC74-5D51-3F5C-BE6E-6B7B9D6F738F}\syshost.exe
"C:\Windows\Installer\{C219EC74-5D51-3F5C-BE6E-6B7B9D6F738F}\syshost.exe" /service
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe -set TESTSIGNING ON
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2716
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe -set TESTSIGNING ON
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2792
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe -set TESTSIGNING ON
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2648
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe -set TESTSIGNING ON
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2560
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe -set TESTSIGNING ON
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2708
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe -set TESTSIGNING ON
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2236
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe -set TESTSIGNING ON
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2808
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe -set TESTSIGNING ON
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2984
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe -set TESTSIGNING ON
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2740
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe -set TESTSIGNING ON
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2736

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2504

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact