b6f677ed348de7160677ca453846e77713ba1b2e9820b03be282956626725eca

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boot/1.bat
Size

2KB
MD5

5796d9a4ba133117ed2873ea8f0a9d52
SHA1

ed249bd98b8da480c8245f20b789f75d8a8621fd
SHA256

1382faa9d7a174cd4d91ae5ea9ae3cde45b2304642cefcc7c1ee133af27f3715
SHA512

10b95f6c3cc8c070ab8c46b5f410caea7aa9811e91aaa0568094897628bd03e36db699892cbd83455259fcf698e2a3e6eeaa9190cb1842078a0fd3c7b2b7e240

Score

9^/10

evasion ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 59 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1020	bcdedit.exe
2320	bcdedit.exe
1896	bcdedit.exe
1852	bcdedit.exe
1884	bcdedit.exe
1812	bcdedit.exe
1628	bcdedit.exe
2244	bcdedit.exe
2300	bcdedit.exe
2516	bcdedit.exe
2520	bcdedit.exe
2384	bcdedit.exe
2080	bcdedit.exe
2708	bcdedit.exe
1676	bcdedit.exe
1648	bcdedit.exe
1624	bcdedit.exe
1684	bcdedit.exe
1840	bcdedit.exe
2136	bcdedit.exe
2324	bcdedit.exe
2308	bcdedit.exe
2616	bcdedit.exe
2936	bcdedit.exe
2528	bcdedit.exe
2932	bcdedit.exe
2956	bcdedit.exe
2544	bcdedit.exe
2264	bcdedit.exe
2564	bcdedit.exe
2592	bcdedit.exe
2632	bcdedit.exe
2672	bcdedit.exe
2636	bcdedit.exe
2684	bcdedit.exe
2688	bcdedit.exe
2580	bcdedit.exe
2628	bcdedit.exe
2568	bcdedit.exe
2952	bcdedit.exe
2796	bcdedit.exe
2552	bcdedit.exe
2704	bcdedit.exe
2596	bcdedit.exe
2472	bcdedit.exe
2652	bcdedit.exe
2768	bcdedit.exe
2776	bcdedit.exe
2464	bcdedit.exe
2460	bcdedit.exe
2892	bcdedit.exe
2600	bcdedit.exe
2608	bcdedit.exe
2480	bcdedit.exe
2492	bcdedit.exe
864	bcdedit.exe
2440	bcdedit.exe
2448	bcdedit.exe
2456	bcdedit.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2916	timeout.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2908	2792	cmd.exe	29
PID 2792 wrote to memory of 2908	2792	cmd.exe	29
PID 2792 wrote to memory of 2908	2792	cmd.exe	29
PID 2792 wrote to memory of 2916	2792	cmd.exe	30
PID 2792 wrote to memory of 2916	2792	cmd.exe	30
PID 2792 wrote to memory of 2916	2792	cmd.exe	30
PID 2792 wrote to memory of 1020	2792	cmd.exe	31
PID 2792 wrote to memory of 1020	2792	cmd.exe	31
PID 2792 wrote to memory of 1020	2792	cmd.exe	31
PID 2792 wrote to memory of 2320	2792	cmd.exe	32
PID 2792 wrote to memory of 2320	2792	cmd.exe	32
PID 2792 wrote to memory of 2320	2792	cmd.exe	32
PID 2792 wrote to memory of 1896	2792	cmd.exe	33
PID 2792 wrote to memory of 1896	2792	cmd.exe	33
PID 2792 wrote to memory of 1896	2792	cmd.exe	33
PID 2792 wrote to memory of 1852	2792	cmd.exe	34
PID 2792 wrote to memory of 1852	2792	cmd.exe	34
PID 2792 wrote to memory of 1852	2792	cmd.exe	34
PID 2792 wrote to memory of 1884	2792	cmd.exe	35
PID 2792 wrote to memory of 1884	2792	cmd.exe	35
PID 2792 wrote to memory of 1884	2792	cmd.exe	35
PID 2792 wrote to memory of 1812	2792	cmd.exe	36
PID 2792 wrote to memory of 1812	2792	cmd.exe	36
PID 2792 wrote to memory of 1812	2792	cmd.exe	36
PID 2792 wrote to memory of 1628	2792	cmd.exe	37
PID 2792 wrote to memory of 1628	2792	cmd.exe	37
PID 2792 wrote to memory of 1628	2792	cmd.exe	37
PID 2792 wrote to memory of 2244	2792	cmd.exe	38
PID 2792 wrote to memory of 2244	2792	cmd.exe	38
PID 2792 wrote to memory of 2244	2792	cmd.exe	38
PID 2792 wrote to memory of 2300	2792	cmd.exe	39
PID 2792 wrote to memory of 2300	2792	cmd.exe	39
PID 2792 wrote to memory of 2300	2792	cmd.exe	39
PID 2792 wrote to memory of 2516	2792	cmd.exe	40
PID 2792 wrote to memory of 2516	2792	cmd.exe	40
PID 2792 wrote to memory of 2516	2792	cmd.exe	40
PID 2792 wrote to memory of 2520	2792	cmd.exe	41
PID 2792 wrote to memory of 2520	2792	cmd.exe	41
PID 2792 wrote to memory of 2520	2792	cmd.exe	41
PID 2792 wrote to memory of 2384	2792	cmd.exe	42
PID 2792 wrote to memory of 2384	2792	cmd.exe	42
PID 2792 wrote to memory of 2384	2792	cmd.exe	42
PID 2792 wrote to memory of 2708	2792	cmd.exe	43
PID 2792 wrote to memory of 2708	2792	cmd.exe	43
PID 2792 wrote to memory of 2708	2792	cmd.exe	43
PID 2792 wrote to memory of 2080	2792	cmd.exe	44
PID 2792 wrote to memory of 2080	2792	cmd.exe	44
PID 2792 wrote to memory of 2080	2792	cmd.exe	44
PID 2792 wrote to memory of 1676	2792	cmd.exe	45
PID 2792 wrote to memory of 1676	2792	cmd.exe	45
PID 2792 wrote to memory of 1676	2792	cmd.exe	45
PID 2792 wrote to memory of 1648	2792	cmd.exe	46
PID 2792 wrote to memory of 1648	2792	cmd.exe	46
PID 2792 wrote to memory of 1648	2792	cmd.exe	46
PID 2792 wrote to memory of 1624	2792	cmd.exe	47
PID 2792 wrote to memory of 1624	2792	cmd.exe	47
PID 2792 wrote to memory of 1624	2792	cmd.exe	47
PID 2792 wrote to memory of 1684	2792	cmd.exe	48
PID 2792 wrote to memory of 1684	2792	cmd.exe	48
PID 2792 wrote to memory of 1684	2792	cmd.exe	48
PID 2792 wrote to memory of 1840	2792	cmd.exe	49
PID 2792 wrote to memory of 1840	2792	cmd.exe	49
PID 2792 wrote to memory of 1840	2792	cmd.exe	49
PID 2792 wrote to memory of 2136	2792	cmd.exe	50

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\boot\1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\system32\mode.com
  mode 105,25
  2⤵
  PID:2908
- C:\Windows\system32\timeout.exe
  timeout 5
  2⤵
  - Delays execution with timeout.exe
  PID:2916
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1020
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2320
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1896
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformclock false
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1852
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1884
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tscsyncpolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1812
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tscsyncpolicy Enhanced
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx AlwaysOff
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2300
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2516
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2520
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2384
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2708
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2080
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1676
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1648
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1624
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1684
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1840
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2136
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2324
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2308
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2616
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2936
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2528
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2932
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2956
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2544
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2264
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2564
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2592
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2632
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2636
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue useplatformclock
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2672
- C:\Windows\system32\bcdedit.exe
  bcdedit /set disabledynamictick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2684
- C:\Windows\system32\bcdedit.exe
  bcdedit /set useplatformtick yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2688
- C:\Windows\system32\bcdedit.exe
  bcdedit /timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2628
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nx optout
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2580
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootux disabled
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2568
- C:\Windows\system32\bcdedit.exe
  bcdedit /set bootmenupolicy standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2952
- C:\Windows\system32\bcdedit.exe
  bcdedit /set hypervisorlaunchtype off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2796
- C:\Windows\system32\bcdedit.exe
  bcdedit /set tpmbootentropy ForceDisable
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set quietboot yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2704
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000067 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2596
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000069 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2472
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} custom:16000068 true
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2652
- C:\Windows\system32\bcdedit.exe
  bcdedit /set linearaddress57 OptOut
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2768
- C:\Windows\system32\bcdedit.exe
  bcdedit /set increaseuserva 268435328
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2776
- C:\Windows\system32\bcdedit.exe
  bcdedit /set firstmegabytepolicy UseAll
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2464
- C:\Windows\system32\bcdedit.exe
  bcdedit /set avoidlowmemory 0x8000000
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2460
- C:\Windows\system32\bcdedit.exe
  bcdedit /set nolowmem Yes
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2892
- C:\Windows\system32\bcdedit.exe
  bcdedit /set allowedinmemorysettings 0x0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2600
- C:\Windows\system32\bcdedit.exe
  bcdedit /set isolatedcontext No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2608
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vsmlaunchtype Off
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2480
- C:\Windows\system32\bcdedit.exe
  bcdedit /set vm No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2492
- C:\Windows\system32\bcdedit.exe
  bcdedit /set configaccesspolicy Default
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:864
- C:\Windows\system32\bcdedit.exe
  bcdedit /set MSI Default
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2440
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usephysicaldestination No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2448
- C:\Windows\system32\bcdedit.exe
  bcdedit /set usefirmwarepcisettings No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads