c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9

Reason

Machine shutdown

General

Target

c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9N.exe
Size

177KB
MD5

f40a4a6faffea79774bdf8b9ade60c60
SHA1

ab74bb77dd0e123796930f2bef2d24d7e4c4cb04
SHA256

c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9
SHA512

3d5d9560d8471d1f4465d25bd79c47201edce3641ee89809fea2fc9bc451f9ff2eb167bc39ec8b1322b1a381a7087ab95b31344b5e38b5a4c951b5dfe788c441
SSDEEP

3072:reMex5XhZInU/oCn+mFuGY0fsZwc1+f8V08IatORiGGYetUM5bZOdZW:rexxlInlE1zY0UZ51+UV08IrEhtrbZOW

Score

9^/10

defense_evasion discovery evasion persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 10 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
744	bcdedit.exe
3904	bcdedit.exe
3836	bcdedit.exe
4724	bcdedit.exe
4772	bcdedit.exe
1880	bcdedit.exe
1440	bcdedit.exe
1884	bcdedit.exe
3176	bcdedit.exe
1272	bcdedit.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\e576169.sys	KB00138886.exe

Enables test signing to bypass driver trust controls 1 TTPs 10 IoCs

Allows any signed driver to load without validation against a trusted certificate authority.

defense_evasion

Code Signing Policy Modification

T1553.006

pid	Process
3904	bcdedit.exe
3836	bcdedit.exe
4724	bcdedit.exe
4772	bcdedit.exe
1440	bcdedit.exe
1272	bcdedit.exe
744	bcdedit.exe
1880	bcdedit.exe
1884	bcdedit.exe
3176	bcdedit.exe

Executes dropped EXE 1 IoCs

pid	Process
552	KB00138886.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KB00138886.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\KB00138886.exe\""	c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9N.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KB00138886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	552	KB00138886.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4988	LogonUI.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 552	1856	c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9N.exe	82
PID 1856 wrote to memory of 552	1856	c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9N.exe	82
PID 1856 wrote to memory of 552	1856	c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9N.exe	82
PID 1856 wrote to memory of 1240	1856	c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9N.exe	83
PID 1856 wrote to memory of 1240	1856	c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9N.exe	83
PID 1856 wrote to memory of 1240	1856	c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9N.exe	83
PID 552 wrote to memory of 744	552	KB00138886.exe	85
PID 552 wrote to memory of 744	552	KB00138886.exe	85
PID 552 wrote to memory of 1272	552	KB00138886.exe	86
PID 552 wrote to memory of 1272	552	KB00138886.exe	86
PID 552 wrote to memory of 3176	552	KB00138886.exe	87
PID 552 wrote to memory of 3176	552	KB00138886.exe	87
PID 552 wrote to memory of 1884	552	KB00138886.exe	88
PID 552 wrote to memory of 1884	552	KB00138886.exe	88
PID 552 wrote to memory of 1440	552	KB00138886.exe	89
PID 552 wrote to memory of 1440	552	KB00138886.exe	89
PID 552 wrote to memory of 1880	552	KB00138886.exe	90
PID 552 wrote to memory of 1880	552	KB00138886.exe	90
PID 552 wrote to memory of 4772	552	KB00138886.exe	91
PID 552 wrote to memory of 4772	552	KB00138886.exe	91
PID 552 wrote to memory of 4724	552	KB00138886.exe	92
PID 552 wrote to memory of 4724	552	KB00138886.exe	92
PID 552 wrote to memory of 3836	552	KB00138886.exe	93
PID 552 wrote to memory of 3836	552	KB00138886.exe	93
PID 552 wrote to memory of 3904	552	KB00138886.exe	94
PID 552 wrote to memory of 3904	552	KB00138886.exe	94

C:\Users\Admin\AppData\Local\Temp\c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9N.exe
"C:\Users\Admin\AppData\Local\Temp\c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9N.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Roaming\KB00138886.exe
  "C:\Users\Admin\AppData\Roaming\KB00138886.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:744
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:1272
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:3176
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:1884
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:1440
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:1880
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:4772
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:4724
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:3836
- - C:\Windows\SYSTEM32\bcdedit.exe
    bcdedit.exe -set TESTSIGNING ON
    3⤵
    - Modifies boot configuration data using bcdedit
    - Enables test signing to bypass driver trust controls
    PID:3904
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\POS6050.tmp.BAT"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1240

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3993855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Subvert Trust Controls

1

T1553

Code Signing Policy Modification

1

T1553.006

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\POS6050.tmp.BAT

Filesize
324B

MD5
01fb17a325ccf6ff303386de75668817

SHA1
ccb8d98b490645ecf212db631727d202dcafc48a

SHA256
b4f35f748e54e5b8662a88dc4ac63f3304479e4e407e07f1ae1c03358b5d40bf

SHA512
bacb592f2495d4084a34fd6c283a1d2d9f5441f4a68e66e112308e2907dc78769f01c6e3df6179b8fc6a44bed0cfd9afe2bb1582bb599cb35e9a7b6a87dd7e19

Download Submit
C:\Users\Admin\AppData\Roaming\KB00138886.exe

Filesize
177KB

MD5
f40a4a6faffea79774bdf8b9ade60c60

SHA1
ab74bb77dd0e123796930f2bef2d24d7e4c4cb04

SHA256
c912bf3bd256028d28d1b13e405ebd412c5ee7e6f8306e910fbef3c6bfcc43c9

SHA512
3d5d9560d8471d1f4465d25bd79c47201edce3641ee89809fea2fc9bc451f9ff2eb167bc39ec8b1322b1a381a7087ab95b31344b5e38b5a4c951b5dfe788c441

Download Submit
memory/552-11-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/552-10-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/552-15-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/552-16-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/552-18-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1856-3-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1856-4-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1856-1-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download
memory/1856-0-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1856-13-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1856-2-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads