7400ee3072280087426fbaa018e1a5bfd1bd41148a5167dbb38420714bd5b328

Reason

Machine shutdown

General

Target
RedTeamIran03.02.26.exe
Size 320KB
Sample260302-txkt3shs2b
SHA256 7400ee3072280087426fbaa018e1a5bfd1bd41148a5167dbb38420714bd5b328
MD5 7cb9ad4470163861a5ce7525cd88ef18
SHA1 b1c13a36499a71bc508f6e67dbf13c9dc3776308
SHA512 6e44e0467f54b0d4828ee47565379af775867f48eed7dcecd342aaec118f6d218948ac4a50756d3016f985bf971259d124ce3a3daedae42f7277b7873a559a56
SSDEEP 6144:+4I5T7HirnsUBbcAadAQt2tfJM+AZai2mzzbaP:+4I5n4skbcrdH+Abz
TLSH
T1AB645C21FB9558FDE157C438824546B2AA337C860B21ADFF229442353F26AF66F3C719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion persistence ransomware

Malware Config

Signatures

Clears Windows event logs 1 TTPs 6 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
5564	wevtutil.exe
2788	wevtutil.exe
4992	wevtutil.exe
1180	wevtutil.exe
1072	wevtutil.exe
5376	wevtutil.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	RedTeamIran03.02.26.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Control Panel\Desktop\Wallpaper	RedTeamIran03.02.26.exe

Modifies Control Panel 3 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Control Panel\Colors\Background = "‰‰0"	RedTeamIran03.02.26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Control Panel\Desktop\WallpaperStyle = "〱"	RedTeamIran03.02.26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000\Control Panel\Desktop\TileWallpaper = "0"	RedTeamIran03.02.26.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "74"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 14 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4992	wevtutil.exe
Token: SeBackupPrivilege	4992	wevtutil.exe
Token: SeSecurityPrivilege	1180	wevtutil.exe
Token: SeBackupPrivilege	1180	wevtutil.exe
Token: SeSecurityPrivilege	1072	wevtutil.exe
Token: SeBackupPrivilege	1072	wevtutil.exe
Token: SeSecurityPrivilege	5376	wevtutil.exe
Token: SeBackupPrivilege	5376	wevtutil.exe
Token: SeSecurityPrivilege	5564	wevtutil.exe
Token: SeBackupPrivilege	5564	wevtutil.exe
Token: SeSecurityPrivilege	2788	wevtutil.exe
Token: SeBackupPrivilege	2788	wevtutil.exe
Token: SeShutdownPrivilege	756	shutdown.exe
Token: SeRemoteShutdownPrivilege	756	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
724	PickerHost.exe
1000	LogonUI.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 4992	4940	RedTeamIran03.02.26.exe	79
PID 4940 wrote to memory of 1180	4940	RedTeamIran03.02.26.exe	81
PID 4940 wrote to memory of 1072	4940	RedTeamIran03.02.26.exe	83
PID 4940 wrote to memory of 5376	4940	RedTeamIran03.02.26.exe	85
PID 4940 wrote to memory of 5564	4940	RedTeamIran03.02.26.exe	87
PID 4940 wrote to memory of 2788	4940	RedTeamIran03.02.26.exe	89
PID 4940 wrote to memory of 1248	4940	RedTeamIran03.02.26.exe	91
PID 4940 wrote to memory of 4420	4940	RedTeamIran03.02.26.exe	93
PID 4940 wrote to memory of 5768	4940	RedTeamIran03.02.26.exe	95
PID 4940 wrote to memory of 756	4940	RedTeamIran03.02.26.exe	97

C:\Users\Admin\AppData\Local\Temp\RedTeamIran03.02.26.exe
"C:\Users\Admin\AppData\Local\Temp\RedTeamIran03.02.26.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4992
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1180
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1072
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl ForwardedEvents
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5376
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Setup
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:5564
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2788
- C:\Windows\system32\cipher.exe
  "cipher" /w: C:
  2⤵
  PID:1248
- C:\Windows\system32\cipher.exe
  "cipher" /w: C:
  2⤵
  PID:4420
- C:\Windows\system32\msg.exe
  "msg" * /TIME:45 "System Maintenance Notification" "This is a RED TEAM EXERCISE - این یک تمرین تیم قرمز است - سیستم شما تحت کنترل است"
  2⤵
  PID:5768
- C:\Windows\system32\shutdown.exe
  "shutdown" /r /f /t 10 /c "Critical system update in progress"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:756

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:724

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a32855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1000