445bc69abbd0eba7c5c4092561043eb80cde9ce361d970782837431f23460e87

Analysis

max time kernel
147s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
26/06/2024, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fps boost tweak/8 BCDEdit Tweaks.cmd
Size 87B
Sample240626-v73cjsvdmc
SHA256 d91becdafb3117e17dbc720e942050953c1e94421bf5ce14ed150ba7e89fa429
MD5 5f2345a1a402bef4241033046a0472a2
SHA1 0ac64069c6c0137a9f74122c11850cbe69e06052
SHA512 93d7746d528dfc1d0511ea9c3aa9531bb4560a20c83f62b7f52a2b369a0bfcae0f04689bcb417e25631a16c34dadd8404ab28fddf312af75f97795eb5442cee2
MD5 SHA1 SHA512

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4972	bcdedit.exe
584	bcdedit.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 4972	3136	cmd.exe	77
PID 3136 wrote to memory of 4972	3136	cmd.exe	77
PID 3136 wrote to memory of 584	3136	cmd.exe	78
PID 3136 wrote to memory of 584	3136	cmd.exe	78

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\fps boost tweak\8 BCDEdit Tweaks.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\system32\bcdedit.exe
  bcdedit -set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4972
- C:\Windows\system32\bcdedit.exe
  bcdedit -set useplatformtick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads