9ba68a024c6d56ea4f0aa7378138afe1a3afd6b1ee313f4ea2f65597387a4acd

Analysis

max time kernel
8s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 22:05

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

STABLE BUILD (RECOMMENDED)/LAUNCHER.exe
Size

24.8MB
MD5

49cf2b05224767dc987f00a214236fa1
SHA1

55f0d9988496a40bafbce94ca4983fb11fb8a8ea
SHA256

5e54acfb38778d8f0170f0ce03dde9085a31d587c9855080adf90d3d28fa427f
SHA512

227cbfb2cf26e9d029b0d3627ee2b8302f1337f6218c534616d6ae7b68cf4b17938674181e4c085aa044aa9999b58b41647eb6d4efbdc9c1132a4e68f2915f02
SSDEEP

393216:lcUkpoaEPPB6yZGSpuVdK+Se0qRjklgE4DcsmFCpnGa2vuOmKZexzIv2Q:lcmZdwq24+UxeYZopnGZvheI2Q

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3148	bcdedit.exe
3308	bcdedit.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	LAUNCHER.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
812	LAUNCHER.exe
812	LAUNCHER.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
812	LAUNCHER.exe
812	LAUNCHER.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	812	LAUNCHER.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 2732	812	LAUNCHER.exe	93
PID 812 wrote to memory of 2732	812	LAUNCHER.exe	93
PID 812 wrote to memory of 2844	812	LAUNCHER.exe	94
PID 812 wrote to memory of 2844	812	LAUNCHER.exe	94
PID 812 wrote to memory of 1896	812	LAUNCHER.exe	97
PID 812 wrote to memory of 1896	812	LAUNCHER.exe	97
PID 812 wrote to memory of 3652	812	LAUNCHER.exe	99
PID 812 wrote to memory of 3652	812	LAUNCHER.exe	99
PID 2732 wrote to memory of 3148	2732	cmd.exe	102
PID 2732 wrote to memory of 3148	2732	cmd.exe	102
PID 3652 wrote to memory of 3308	3652	cmd.exe	103
PID 3652 wrote to memory of 3308	3652	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\STABLE BUILD (RECOMMENDED)\LAUNCHER.exe
"C:\Users\Admin\AppData\Local\Temp\STABLE BUILD (RECOMMENDED)\LAUNCHER.exe"
1⤵
- Checks computer location settings
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /set hypervisorlaunchtype auto
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set hypervisorlaunchtype auto
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 0 /f
  2⤵
  PID:2844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" reg add "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f
  2⤵
  PID:1896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C bcdedit /default {current}
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\system32\bcdedit.exe
    bcdedit /default {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact