66cf7d06e6cf6413d3e9e6a488f7528f5c6d06057abec20496f70d1691fbdfb2

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Downloads 12.6.24/Downloads 12.6.24/Downloads/Silent Chair/w11 fix.bat
Size 507B
Sample240811-3bewdaybpc
SHA256 7ec1b31de3b0114c266df0b475c5c582a504c7c38f7127949df27f78a5d1c026
MD5 6fb44052dc5a85a097feeb91d7a81712
SHA1 29db33e6cf3286a6ba82af684ac535d42b43d257
SHA512 ee9dbcc0a7340ec6fe968ba611f0849fd1b77b88cb5deaad4c6a516a417abaf14055021e949ca04fde979364f060504c911fede81b0c492b651ea1b3f246494a
MD5 SHA1 SHA512

Score

9^/10

defense_evasion evasion execution ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2808	bcdedit.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2824	powershell.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2776	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2824	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2196	2852	cmd.exe	31
PID 2852 wrote to memory of 2196	2852	cmd.exe	31
PID 2852 wrote to memory of 2196	2852	cmd.exe	31
PID 2196 wrote to memory of 2620	2196	net.exe	32
PID 2196 wrote to memory of 2620	2196	net.exe	32
PID 2196 wrote to memory of 2620	2196	net.exe	32
PID 2852 wrote to memory of 2808	2852	cmd.exe	33
PID 2852 wrote to memory of 2808	2852	cmd.exe	33
PID 2852 wrote to memory of 2808	2852	cmd.exe	33
PID 2852 wrote to memory of 2824	2852	cmd.exe	34
PID 2852 wrote to memory of 2824	2852	cmd.exe	34
PID 2852 wrote to memory of 2824	2852	cmd.exe	34
PID 2852 wrote to memory of 2776	2852	cmd.exe	35
PID 2852 wrote to memory of 2776	2852	cmd.exe	35
PID 2852 wrote to memory of 2776	2852	cmd.exe	35

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Downloads 12.6.24\Downloads 12.6.24\Downloads\Silent Chair\w11 fix.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2620
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -Command "Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Windows\system32\reg.exe
  reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0x000000
  2⤵
  - Modify Registry: Disable Windows Driver Blocklist
  - Modifies registry key
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2824-4-0x000007FEF5A8E000-0x000007FEF5A8F000-memory.dmp

Download

memory/2824-5-0x000000001B530000-0x000000001B812000-memory.dmp

Download

memory/2824-6-0x00000000022D0000-0x00000000022D8000-memory.dmp

Download

memory/2824-7-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Download

memory/2824-9-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Download

memory/2824-8-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Download

memory/2824-10-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Download

memory/2824-11-0x000007FEF57D0000-0x000007FEF616D000-memory.dmp

Download