3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b

Reason

Machine shutdown

General

Target
jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe
Size 506KB
Sample261002-leldwsshrc
SHA256 3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b
MD5 b4ae852b8c2865d300a8ec7f1e9b83f7
SHA1 f5de2093fc438eb1aa570d63dd2b66973dcc9430
SHA512 266f873f0a3ae607393d813660c0709c992fb6a0fc058d53ca4d3b6b2a3362d6a12b80de4deb57632dfaafc25b3ee31f05ab4649559c0e86131ece6792bbc939
SSDEEP 12288:+EG3fFZh9mVsEY9X5AY+Vm0RcoGLIxQydyQiQ5Q:+X3fDb8FRcoGLIXIQiQK
TLSH
T16DB47D01B3D280B1E74566B01CBBE739BA704A897F2457C3F7E8ED695D321E0E53A11A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 1 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMSS = "C:\\Windows\\system32\\Com\\SMSS.EXE"	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe

Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "70"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2248	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2248	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe
2248	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe
2248	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe
2248	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe
2248	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe
2248	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe
2248	jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe
3852	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_3f1b2f2b998b500d1787f5eb0a06201266d9d409ee3895d852a50aa4ed7f098b.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Indicator Removal: Clear Persistence
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2248

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3956055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3852