c0b342d196d65de8ad021869f81ecd82e1934ed22c3bbc21a6bcec46b97ba35d

Reason

Machine shutdown

General

Target
example.bat
Size 542B
Sample261027-dev94ah15z
SHA256 c0b342d196d65de8ad021869f81ecd82e1934ed22c3bbc21a6bcec46b97ba35d
MD5 cbdcd710a7291d06505973c0111f46d5
SHA1 f21a34345e05b1e17283d7543df8e6f0c7e53ddb
SHA512 71859ea22a3a941195e84006567a30a392dbdafe53c736adb5a29f94d615d7616dbdb5f6029abf050b690f04a8d74e77e0301cc2bd68d3023fb640a9a0f6d056
TLSH
T1BFF0C02D2300A14349394272F816B09DEC1401162B6B5C72278BE3B06DB70DFEEBA5C5
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution ransomware

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2720	wscript.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2608	cmd.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "250"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2084	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1280	powershell.exe
1280	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1280	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1220	LogonUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1280	2608	cmd.exe	85
PID 2608 wrote to memory of 2720	2608	cmd.exe	86
PID 2608 wrote to memory of 2084	2608	cmd.exe	91

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\example.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -c (New-Object Media.SoundPlayer "$env:windir\Media\Windows Error.wav").PlaySync()
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1280
- C:\Windows\system32\wscript.exe
  wscript "C:\Users\Admin\AppData\Local\Temp\err.vbs"
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  PID:2720
- C:\Windows\system32\notepad.exe
  notepad "C:\Users\Admin\AppData\Local\Temp\wavy_error.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2084

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b9055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

Visual Basic

1

T1059.005

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_nw12p551.pic.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nw12p551.pic.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

err.vbs

Path C:\Users\Admin\AppData\Local\Temp\err.vbs
Size 62B
SHA256 c94160da267ccd02cd8ebcdec5fd263016d42454b72ece6ba5d13c36b93a2f90
MD5 1117360c582f56e9a9093b12dad6322b
SHA1 08595e1efbe03426ec5b8affb9beae975327e2ee
SHA512 aee2f391056064655c4fff52f29d2be6c58b26659e10ab7ea12330885843465fdb46ab2caa67159eabc3ad72928db66bf512355c3e8c07b5c605695405d926d1
TLSH
T1AAA00256332955EAD16893075907E8DB3524E08D4A6E83E9069801556954442CEE2293
MD5 SHA1 SHA512 TLSH

Submit Download

wavy_error.txt

Path C:\Users\Admin\AppData\Local\Temp\wavy_error.txt
Size 97B
SHA256 817cd69276748b1a62dd8a384606df86fc8dd81e3b6b21fc940c6f137a8a97ff
MD5 9a482e8d514270fd62dd85be32a897da
SHA1 5a38be4c74699e0946dd151fdc778c03d50bccb8
SHA512 9baf30a1df5abb64f47fb4f11156e4ee6cdca0247ea43290693791adef138b838b349d699f8b2b32bbc1d52608eea2dd34c881f00ed15d3b45f45d637f9be4a4
TLSH
T160B001AC6620509268864288EC05563D5CEC05226AD36959AC6BF3119D7943D1599479
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1280-0-0x000001A78F2A0000-0x000001A78F2B0000-memory.dmp

Download

memory/1280-1-0x000001A78F2A0000-0x000001A78F2B0000-memory.dmp

Download

memory/1280-9-0x000001A78F270000-0x000001A78F292000-memory.dmp

Download

memory/1280-10-0x000001A78F2A0000-0x000001A78F2B0000-memory.dmp

Download

memory/1280-13-0x000001A7A74D0000-0x000001A7A76EC000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads