142ddead87444051ea690f4053007715afd2841a7565f61b2b8f891ce3919dae

Reason

Machine shutdown

General

Target
142ddead87444051ea690f4053007715afd2841a7565f61b2b8f891ce3919dae.exe
Size 1.5MB
Sample240605-qrmjyahd82
SHA256 142ddead87444051ea690f4053007715afd2841a7565f61b2b8f891ce3919dae
MD5 6f55c3346a40e03a8ec4d32e267b003b
SHA1 446f9a6815aaf5cd5f1e12be450f01b0e0a02d62
SHA512 60e8c8dc127684bbf42b1eeef5c7d1f2e3a4afcf37e4e559d7fa3494db6d4c0889335804f2d3cecca525abb3d3704a7793c7d0864d9c3342eabc6fd07fd6670e
SSDEEP 24576:eVxZaPDGjnI+GyfdSNbsZM6mLcGkAexyIdbb/KzmKIoxztozSqvn:eVgGjI+Nf4LCFy2RDoztKS+
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
908	bcdedit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	142ddead87444051ea690f4053007715afd2841a7565f61b2b8f891ce3919dae.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "95"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4008	shutdown.exe
Token: SeRemoteShutdownPrivilege	4008	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5116	LogonUI.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4568 wrote to memory of 2936	4568	142ddead87444051ea690f4053007715afd2841a7565f61b2b8f891ce3919dae.exe	83
PID 4568 wrote to memory of 2936	4568	142ddead87444051ea690f4053007715afd2841a7565f61b2b8f891ce3919dae.exe	83
PID 4568 wrote to memory of 692	4568	142ddead87444051ea690f4053007715afd2841a7565f61b2b8f891ce3919dae.exe	85
PID 4568 wrote to memory of 692	4568	142ddead87444051ea690f4053007715afd2841a7565f61b2b8f891ce3919dae.exe	85
PID 692 wrote to memory of 1416	692	cmd.exe	88
PID 692 wrote to memory of 1416	692	cmd.exe	88
PID 692 wrote to memory of 2172	692	cmd.exe	89
PID 692 wrote to memory of 2172	692	cmd.exe	89
PID 692 wrote to memory of 908	692	cmd.exe	90
PID 692 wrote to memory of 908	692	cmd.exe	90
PID 692 wrote to memory of 4008	692	cmd.exe	91
PID 692 wrote to memory of 4008	692	cmd.exe	91

C:\Users\Admin\AppData\Local\Temp\142ddead87444051ea690f4053007715afd2841a7565f61b2b8f891ce3919dae.exe
"C:\Users\Admin\AppData\Local\Temp\142ddead87444051ea690f4053007715afd2841a7565f61b2b8f891ce3919dae.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "CONTATO & SUPORTE (direto).png" "C:\Users\Admin\Desktop\"
  2⤵
  PID:2936
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Addon\Arquivos de Programas\Adicionais\64bits\SAFEMODE-CHECK.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\system32\bcdedit.exe
    bcdedit
    3⤵
    PID:1416
- - C:\Windows\system32\find.exe
    find "safeboot"
    3⤵
    PID:2172
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {current} safeboot network
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:908
- - C:\Windows\system32\shutdown.exe
    shutdown -r -t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4008

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39a0055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

CONTATO & SUPORTE (direto).png

Path C:\Addon\Arquivos de Programas\Adicionais\64bits\CONTATO & SUPORTE (direto).png
Size 1.0MB
SHA256 afeb05e883632445e11d40bd24b3673e8c3c61ed2672722a91c536043b54d768
MD5 8153cf9c7d666fd9d4d9cb857258e6aa
SHA1 c97b232df2027033e1ed3a119aacf46e025e99f8
SHA512 8d7943a13ea4452fc8eab2d615eda90d9de324d26d2af2ed78a0f0d946cb8c59325f020c3b5c82bbdb04b46d942fcef159fa5a61458fa24a919c9c35132bd9d6
SSDEEP 24576:FdSNbsZM6mLcGkAexyIdbb/KzmKIoxztozSqvn:jf4LCFy2RDoztKS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

SAFEMODE-CHECK.bat

Path C:\Addon\Arquivos de Programas\Adicionais\64bits\SAFEMODE-CHECK.bat
Size 1KB
SHA256 036643b32e2e8586003505380d0febdbfb54e11d1f02d06b12bf714a8e0bb5c0
MD5 cddf4916236ca7ac187ee5d98e66c0b6
SHA1 d0c1b3df9170e82d4fa95ec83ae3504033498cd2
SHA512 50789c7098c2ae956f3a1faa996b6ae7954fe02604430ed16c5606e956b26f0666c6e8329dd5c8eb0784a2f2b60a3ad067b0568dc0509529c09eb756221ee89a
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

Errors