00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09

Reason

Machine shutdown

General

Target
jaffacakes118_00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09.exe
Size 77KB
Sample260925-ffa2nattbx
SHA256 00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09
MD5 9586f174a11afc4beeeedf1b08c779ac
SHA1 50b866eeaad9b6089f81edf1f67ff32a854e52dd
SHA512 08b11e4cbe7c0927368df11017497bd9e5210b781c677de8f58bfd1c2850fa8f363065451ec420a651dbe86e81535eaeadcbda4b927ee955e23a46554f915f77
SSDEEP 768:8BoCLXuB0qW1RLV0R3upU5RrDdUssPPelAIGhInMkQ/zvEDfn1Jtq6zhx6klKYyl:QoKusDOR3TdsPP6HKtkz1JEkbyXV
TLSH
T10D737C02BB94D0B2E05141746434DBA2993EBD3117758287F7C93ABBBE713E19B2831B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\2979115482 = "C:\\Users\\Admin\\2979115482\\2979115482.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\2979115482_del = "cmd /c del \"C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09.exe\""	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5772	cmd.exe
5484	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4708	shutdown.exe
Token: SeRemoteShutdownPrivilege	4708	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5940	LogonUI.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 5772	1340	jaffacakes118_00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09.exe	89
PID 5772 wrote to memory of 5972	5772	cmd.exe	91
PID 1340 wrote to memory of 5484	1340	jaffacakes118_00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09.exe	92
PID 1340 wrote to memory of 4708	1340	jaffacakes118_00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09.exe	94
PID 5484 wrote to memory of 1548	5484	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2979115482 /t REG_SZ /d "C:\Users\Admin\2979115482\2979115482.exe" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2979115482 /t REG_SZ /d "C:\Users\Admin\2979115482\2979115482.exe" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:5972
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2979115482_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09.exe\"" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5484
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2979115482_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_00e6130b2e52a0ef8f7b7d9c15032c6c90e533272dacc40c2fc12eb21549dd09.exe\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:1548
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /R /F /T 0
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4708

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2a055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5940