6ded493c628879e253cf0ed8b08b404e67143f20a039616f6967a1aac249d67c

Analysis

max time kernel
50s
max time network
53s
platform
windows11-21h2_x64
resource
win11-20240214-en
resource tags

arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
submitted
20/02/2024, 18:46

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

TEST_ranodm_things.exe
Size

4.2MB
MD5

cd5cbd2a7014349ddf809f63ac161443
SHA1

88d748bd9c1fd90809de4ff4fbadfecb9b2dd0a1
SHA256

6ded493c628879e253cf0ed8b08b404e67143f20a039616f6967a1aac249d67c
SHA512

8b6a91b52c2991638e11594b44d131b1b11bf1391d930ad88691dba4c33ba175fa79731af4600a7620a786410374d964a7960c3916e8b8e318ea3c17ac3c5f24
SSDEEP

98304:g0jE0CBdh4jTelA0bPcVpzj3yyqi0pjTlMMm07VZBqF:DjEhhaiA8kVpIisTl/7RZe

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "126"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4116	shutdown.exe
Token: SeRemoteShutdownPrivilege	4116	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3112	PickerHost.exe
4604	LogonUI.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 2328	3468	TEST_ranodm_things.exe	80
PID 3468 wrote to memory of 2328	3468	TEST_ranodm_things.exe	80
PID 3468 wrote to memory of 2328	3468	TEST_ranodm_things.exe	80
PID 2328 wrote to memory of 4116	2328	cmd.exe	82
PID 2328 wrote to memory of 4116	2328	cmd.exe	82
PID 2328 wrote to memory of 4116	2328	cmd.exe	82

C:\Users\Admin\AppData\Local\Temp\TEST_ranodm_things.exe
"C:\Users\Admin\AppData\Local\Temp\TEST_ranodm_things.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k shutdown -s & color a & dir/s
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -s
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4116

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3112

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a0f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3468-1-0x0000000000F50000-0x0000000001380000-memory.dmp

Filesize
4.2MB

Download
memory/3468-0-0x0000000074C50000-0x0000000075401000-memory.dmp

Filesize
7.7MB

Download
memory/3468-2-0x0000000006350000-0x00000000068F6000-memory.dmp

Filesize
5.6MB

Download
memory/3468-3-0x0000000005E40000-0x0000000005ED2000-memory.dmp

Filesize
584KB

Download
memory/3468-4-0x0000000006070000-0x0000000006080000-memory.dmp

Filesize
64KB

Download
memory/3468-5-0x0000000005E30000-0x0000000005E3A000-memory.dmp

Filesize
40KB

Download
memory/3468-6-0x0000000006070000-0x0000000006080000-memory.dmp

Filesize
64KB

Download
memory/3468-7-0x0000000074C50000-0x0000000075401000-memory.dmp

Filesize
7.7MB

Download
memory/3468-8-0x0000000006070000-0x0000000006080000-memory.dmp

Filesize
64KB

Download
memory/3468-9-0x0000000006070000-0x0000000006080000-memory.dmp

Filesize
64KB

Download
memory/3468-10-0x0000000074C50000-0x0000000075401000-memory.dmp

Filesize
7.7MB

Download