12f4a3d856f41dd24cc6affed8739851d837a317f6eadbed2f943fd5853d9025

Reason

Machine shutdown

General

Target

92b12fe648b47778e2a4650c5879435d.exe
Size

26KB
MD5

92b12fe648b47778e2a4650c5879435d
SHA1

ead32e4e4792f5f1ae793e1faa9b5c62a0c83bfd
SHA256

12f4a3d856f41dd24cc6affed8739851d837a317f6eadbed2f943fd5853d9025
SHA512

886f7f8317b54cc77aeebe9bf9ab0b805e3561c0d588fdfab2a268eeedf97169cb32a40082fd09bbfb7d089c85f01b5fd7ec1843c0cd5ec9964a2b45ca30fa53
SSDEEP

768:iykaN68NHRVVA4Tc6ArEbrlHT7OJV0Ex:iykaw8PVJAr+HTCJC

Score

8^/10

evasion

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	svchost.exe

Deletes itself 1 IoCs

Processes:

svchost.exe

pid process

1732 svchost.exe
Executes dropped EXE 2 IoCs

Processes:

03192A897B73CCFF8646.exe03192A897B73CCFF8646.exe

pid process

2756 03192A897B73CCFF8646.exe
2524 03192A897B73CCFF8646.exe
Loads dropped DLL 3 IoCs

Processes:

svchost.exe03192A897B73CCFF8646.exe

pid process

1732 svchost.exe
1732 svchost.exe
2756 03192A897B73CCFF8646.exe

pid	process
1732	svchost.exe

pid	process
2756	03192A897B73CCFF8646.exe
2524	03192A897B73CCFF8646.exe

pid	process
1732	svchost.exe
1732	svchost.exe
2756	03192A897B73CCFF8646.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

92b12fe648b47778e2a4650c5879435d.exe03192A897B73CCFF8646.exe

description	pid	process	target process
PID 2064 set thread context of 2068	2064	92b12fe648b47778e2a4650c5879435d.exe	92b12fe648b47778e2a4650c5879435d.exe
PID 2756 set thread context of 2524	2756	03192A897B73CCFF8646.exe	03192A897B73CCFF8646.exe

Drops file in Windows directory 3 IoCs

Processes:

DrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe

Modifies Control Panel 2 IoCs

evasion

Processes:

92b12fe648b47778e2a4650c5879435d.exe03192A897B73CCFF8646.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\PowerCfg	92b12fe648b47778e2a4650c5879435d.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Control Panel\PowerCfg	03192A897B73CCFF8646.exe

Modifies data under HKEY_USERS 43 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

svchost.exevssvc.exeDrvInst.exeshutdown.exe

description	pid	process
Token: SeSystemProfilePrivilege	1732	svchost.exe
Token: SeBackupPrivilege	2696	vssvc.exe
Token: SeRestorePrivilege	2696	vssvc.exe
Token: SeAuditPrivilege	2696	vssvc.exe
Token: SeRestorePrivilege	1220	DrvInst.exe
Token: SeRestorePrivilege	1220	DrvInst.exe
Token: SeRestorePrivilege	1220	DrvInst.exe
Token: SeRestorePrivilege	1220	DrvInst.exe
Token: SeRestorePrivilege	1220	DrvInst.exe
Token: SeRestorePrivilege	1220	DrvInst.exe
Token: SeRestorePrivilege	1220	DrvInst.exe
Token: SeLoadDriverPrivilege	1220	DrvInst.exe
Token: SeLoadDriverPrivilege	1220	DrvInst.exe
Token: SeLoadDriverPrivilege	1220	DrvInst.exe
Token: SeShutdownPrivilege	2936	shutdown.exe
Token: SeRemoteShutdownPrivilege	2936	shutdown.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

92b12fe648b47778e2a4650c5879435d.exe92b12fe648b47778e2a4650c5879435d.exesvchost.exe03192A897B73CCFF8646.exe03192A897B73CCFF8646.exe

description	pid	process	target process
PID 2064 wrote to memory of 2068	2064	92b12fe648b47778e2a4650c5879435d.exe	92b12fe648b47778e2a4650c5879435d.exe
PID 2064 wrote to memory of 2068	2064	92b12fe648b47778e2a4650c5879435d.exe	92b12fe648b47778e2a4650c5879435d.exe
PID 2064 wrote to memory of 2068	2064	92b12fe648b47778e2a4650c5879435d.exe	92b12fe648b47778e2a4650c5879435d.exe
PID 2064 wrote to memory of 2068	2064	92b12fe648b47778e2a4650c5879435d.exe	92b12fe648b47778e2a4650c5879435d.exe
PID 2064 wrote to memory of 2068	2064	92b12fe648b47778e2a4650c5879435d.exe	92b12fe648b47778e2a4650c5879435d.exe
PID 2064 wrote to memory of 2068	2064	92b12fe648b47778e2a4650c5879435d.exe	92b12fe648b47778e2a4650c5879435d.exe
PID 2064 wrote to memory of 2068	2064	92b12fe648b47778e2a4650c5879435d.exe	92b12fe648b47778e2a4650c5879435d.exe
PID 2064 wrote to memory of 2068	2064	92b12fe648b47778e2a4650c5879435d.exe	92b12fe648b47778e2a4650c5879435d.exe
PID 2064 wrote to memory of 2068	2064	92b12fe648b47778e2a4650c5879435d.exe	92b12fe648b47778e2a4650c5879435d.exe
PID 2068 wrote to memory of 1732	2068	92b12fe648b47778e2a4650c5879435d.exe	svchost.exe
PID 2068 wrote to memory of 1732	2068	92b12fe648b47778e2a4650c5879435d.exe	svchost.exe
PID 2068 wrote to memory of 1732	2068	92b12fe648b47778e2a4650c5879435d.exe	svchost.exe
PID 2068 wrote to memory of 1732	2068	92b12fe648b47778e2a4650c5879435d.exe	svchost.exe
PID 2068 wrote to memory of 1732	2068	92b12fe648b47778e2a4650c5879435d.exe	svchost.exe
PID 1732 wrote to memory of 2112	1732	svchost.exe	reg.exe
PID 1732 wrote to memory of 2112	1732	svchost.exe	reg.exe
PID 1732 wrote to memory of 2112	1732	svchost.exe	reg.exe
PID 1732 wrote to memory of 2112	1732	svchost.exe	reg.exe
PID 1732 wrote to memory of 2936	1732	svchost.exe	shutdown.exe
PID 1732 wrote to memory of 2936	1732	svchost.exe	shutdown.exe
PID 1732 wrote to memory of 2936	1732	svchost.exe	shutdown.exe
PID 1732 wrote to memory of 2936	1732	svchost.exe	shutdown.exe
PID 1732 wrote to memory of 2756	1732	svchost.exe	03192A897B73CCFF8646.exe
PID 1732 wrote to memory of 2756	1732	svchost.exe	03192A897B73CCFF8646.exe
PID 1732 wrote to memory of 2756	1732	svchost.exe	03192A897B73CCFF8646.exe
PID 1732 wrote to memory of 2756	1732	svchost.exe	03192A897B73CCFF8646.exe
PID 2756 wrote to memory of 2524	2756	03192A897B73CCFF8646.exe	03192A897B73CCFF8646.exe
PID 2756 wrote to memory of 2524	2756	03192A897B73CCFF8646.exe	03192A897B73CCFF8646.exe
PID 2756 wrote to memory of 2524	2756	03192A897B73CCFF8646.exe	03192A897B73CCFF8646.exe
PID 2756 wrote to memory of 2524	2756	03192A897B73CCFF8646.exe	03192A897B73CCFF8646.exe
PID 2756 wrote to memory of 2524	2756	03192A897B73CCFF8646.exe	03192A897B73CCFF8646.exe
PID 2756 wrote to memory of 2524	2756	03192A897B73CCFF8646.exe	03192A897B73CCFF8646.exe
PID 2756 wrote to memory of 2524	2756	03192A897B73CCFF8646.exe	03192A897B73CCFF8646.exe
PID 2756 wrote to memory of 2524	2756	03192A897B73CCFF8646.exe	03192A897B73CCFF8646.exe
PID 2756 wrote to memory of 2524	2756	03192A897B73CCFF8646.exe	03192A897B73CCFF8646.exe
PID 2524 wrote to memory of 1192	2524	03192A897B73CCFF8646.exe	svchost.exe
PID 2524 wrote to memory of 1192	2524	03192A897B73CCFF8646.exe	svchost.exe
PID 2524 wrote to memory of 1192	2524	03192A897B73CCFF8646.exe	svchost.exe
PID 2524 wrote to memory of 1192	2524	03192A897B73CCFF8646.exe	svchost.exe
PID 2524 wrote to memory of 1192	2524	03192A897B73CCFF8646.exe	svchost.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\92b12fe648b47778e2a4650c5879435d.exe
"C:\Users\Admin\AppData\Local\Temp\92b12fe648b47778e2a4650c5879435d.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:2064

C:\Users\Admin\AppData\Local\Temp\92b12fe648b47778e2a4650c5879435d.exe
C:\Users\Admin\AppData\Local\Temp\92b12fe648b47778e2a4650c5879435d.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2068

C:\Windows\SysWOW64\svchost.exe
svchost.exe
3⤵
- Disables RegEdit via registry modification
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\reg.exe
reg.exe add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"
4⤵
PID:2112

C:\Windows\SysWOW64\shutdown.exe
shutdown.exe -r -f -t 0
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2936

C:\Users\Admin\AppData\Local\Temp\03192A897B73CCFF8646.exe
C:\Users\Admin\AppData\Local\Temp\03192A897B73CCFF8646.exe
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:2756

C:\Users\Admin\AppData\Local\Temp\03192A897B73CCFF8646.exe
C:\Users\Admin\AppData\Local\Temp\03192A897B73CCFF8646.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524

C:\Windows\SysWOW64\svchost.exe
svchost.exe
6⤵
PID:1192

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005B0" "00000000000005AC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1220

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:868

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2132

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\03192A897B73CCFF8646.exe
Filesize
26KB

MD5
92b12fe648b47778e2a4650c5879435d

SHA1
ead32e4e4792f5f1ae793e1faa9b5c62a0c83bfd

SHA256
12f4a3d856f41dd24cc6affed8739851d837a317f6eadbed2f943fd5853d9025

SHA512
886f7f8317b54cc77aeebe9bf9ab0b805e3561c0d588fdfab2a268eeedf97169cb32a40082fd09bbfb7d089c85f01b5fd7ec1843c0cd5ec9964a2b45ca30fa53

Download Submit
memory/868-43-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/1192-38-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

Filesize
56KB

Download
memory/1192-45-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

Filesize
56KB

Download
memory/1192-42-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

Filesize
56KB

Download
memory/1192-36-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

Filesize
56KB

Download
memory/1732-18-0x0000000000100000-0x000000000010A000-memory.dmp

Filesize
40KB

Download
memory/1732-34-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

Filesize
56KB

Download
memory/1732-10-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

Filesize
56KB

Download
memory/1732-11-0x000000007EFA0000-0x000000007EFAE000-memory.dmp

Filesize
56KB

Download
memory/2064-1-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/2064-6-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2064-0-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2068-2-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2068-9-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2068-8-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2068-3-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2068-4-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2132-48-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/2524-39-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2756-26-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads