0b46e3c19fa4c97f25e7fa8c08e9d93ce6f2f5f8869281f4539e2e7b3fbb219e

Analysis

max time kernel
83s
max time network
90s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 08:14

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

0 - GOS CONNECT.bat
Size

6KB
MD5

53c17e0a3a08766db5abf1ecf0b1e17f
SHA1

44f0963e050ee52b7ba489c2594c10f764c49639
SHA256

0b46e3c19fa4c97f25e7fa8c08e9d93ce6f2f5f8869281f4539e2e7b3fbb219e
SHA512

97ccd16ca349cac05f1b2b9ab1cd87a7c8c97e06d5fed353626b8a9bf9e46fbc31c11b14d3c0288198170e69c6ba68d655b891cb36e05b762bc7848da48cbdaf
SSDEEP

96:MfHeI8wuookU7kz4ZU3wMO/wO/7Xszs5BMn:ceIBqkUZH1rGn

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2268	netsh.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1020	ipconfig.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "235"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4592	PING.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	936	shutdown.exe
Token: SeRemoteShutdownPrivilege	936	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4984	LogonUI.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 4204	568	cmd.exe	89
PID 568 wrote to memory of 4204	568	cmd.exe	89
PID 568 wrote to memory of 4604	568	cmd.exe	90
PID 568 wrote to memory of 4604	568	cmd.exe	90
PID 568 wrote to memory of 4592	568	cmd.exe	93
PID 568 wrote to memory of 4592	568	cmd.exe	93
PID 568 wrote to memory of 2268	568	cmd.exe	102
PID 568 wrote to memory of 2268	568	cmd.exe	102
PID 568 wrote to memory of 1020	568	cmd.exe	103
PID 568 wrote to memory of 1020	568	cmd.exe	103
PID 568 wrote to memory of 3472	568	cmd.exe	104
PID 568 wrote to memory of 3472	568	cmd.exe	104
PID 568 wrote to memory of 936	568	cmd.exe	105
PID 568 wrote to memory of 936	568	cmd.exe	105

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\0 - GOS CONNECT.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:568
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:4204
- C:\Windows\system32\mode.com
  mode con: cols=86 lines=32
  2⤵
  PID:4604
- C:\Windows\system32\PING.EXE
  ping www.google.com
  2⤵
  - Runs ping.exe
  PID:4592
- C:\Windows\system32\netsh.exe
  netsh firewall set opmode disable
  2⤵
  - Modifies Windows Firewall
  PID:2268
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:1020
- C:\Windows\system32\netsh.exe
  netsh winsock reset
  2⤵
  PID:3472
- C:\Windows\system32\shutdown.exe
  shutdown /r
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:936

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b9055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4984