225c8a3cab0e7b7cf52596a822ecaf75f7826ff89f0e58df190118b988699e8a

Analysis

max time kernel
7s
max time network
1s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 19:04

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

LAUNCHER(1).exe
Size

26.5MB
MD5

2b9574243ce737564c4d808a471b33b8
SHA1

c6a7dbe1bc73ff72c137cdc896c746e77df2ce80
SHA256

225c8a3cab0e7b7cf52596a822ecaf75f7826ff89f0e58df190118b988699e8a
SHA512

5c7aa363baa56d99a79a80f29c5b1d79c5f3ebf359d33e1770d590fa2ad571f32298e4159c02254db3596ab3c82b03dc02a772d41764391d3caba8e738bf60d3
SSDEEP

786432:bHGtKH1jlC42OaZSKNBWkGoCsoM5JX8e:bHGSJ34ZBWkIsoMHX

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2864	bcdedit.exe
2576	bcdedit.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2672	LAUNCHER(1).exe
2672	LAUNCHER(1).exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2672	LAUNCHER(1).exe

C:\Users\Admin\AppData\Local\Temp\LAUNCHER(1).exe
"C:\Users\Admin\AppData\Local\Temp\LAUNCHER(1).exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /set hypervisorlaunchtype auto
  2⤵
  PID:2392
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set hypervisorlaunchtype auto
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:2724
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f
  2⤵
  PID:3004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /default {current}
  2⤵
  PID:2720
- - C:\Windows\system32\bcdedit.exe
    bcdedit /default {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact