5eb285443b7b9ab49c8b73112f66813eacc811d752e294fd2ca8db89da49589d

Reason

Machine shutdown

General

Target
Dubi助手[已更新].exe
Size 5.5MB
Sample201003-t28dwtaawa
SHA256 5eb285443b7b9ab49c8b73112f66813eacc811d752e294fd2ca8db89da49589d
MD5 51b94137e88771042db62d5f1038dc58
SHA1 d0d2cd4e6de3314a61df6519e89600e6ea43dce7
SHA512 8d4b52b5e421d434771dc3cfaea074ad285976b371d108fc67b9c02eca288997910c78e211a571d76cec2cf3878f03143d8a730eb08656378be1d175f8bc8513
MD5 SHA1 SHA512

Score

9^/10

ransomware bootkit persistence

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs

Enables rebooting of the machine without requiring login credentials.

ransomware bootkit

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoLogonChecked	LogonUI.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\physicaldrive0	Dubi助手[已更新].exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2080	Dubi助手[已更新].exe
2080	Dubi助手[已更新].exe
2080	Dubi助手[已更新].exe
2080	Dubi助手[已更新].exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2080	Dubi助手[已更新].exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2080	Dubi助手[已更新].exe
2080	Dubi助手[已更新].exe
3884	LogonUI.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2608	2080	Dubi助手[已更新].exe	72
PID 2080 wrote to memory of 2608	2080	Dubi助手[已更新].exe	72
PID 2080 wrote to memory of 2608	2080	Dubi助手[已更新].exe	72
PID 2080 wrote to memory of 2616	2080	Dubi助手[已更新].exe	73
PID 2080 wrote to memory of 2616	2080	Dubi助手[已更新].exe	73
PID 2080 wrote to memory of 2616	2080	Dubi助手[已更新].exe	73
PID 2080 wrote to memory of 2664	2080	Dubi助手[已更新].exe	74
PID 2080 wrote to memory of 2664	2080	Dubi助手[已更新].exe	74
PID 2080 wrote to memory of 2664	2080	Dubi助手[已更新].exe	74
PID 2664 wrote to memory of 692	2664	net.exe	79
PID 2664 wrote to memory of 692	2664	net.exe	79
PID 2664 wrote to memory of 692	2664	net.exe	79
PID 2608 wrote to memory of 1020	2608	net.exe	80
PID 2608 wrote to memory of 1020	2608	net.exe	80
PID 2608 wrote to memory of 1020	2608	net.exe	80
PID 2616 wrote to memory of 752	2616	net.exe	81
PID 2616 wrote to memory of 752	2616	net.exe	81
PID 2616 wrote to memory of 752	2616	net.exe	81

C:\Users\Admin\AppData\Local\Temp\Dubi助手[已更新].exe
"C:\Users\Admin\AppData\Local\Temp\Dubi助手[已更新].exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\net.exe
  net user Administrator zuimengzhenshuai1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 user Administrator zuimengzhenshuai1
    3⤵
    PID:1020
- C:\Windows\SysWOW64\net.exe
  net user zuimeng 123456 /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 user zuimeng 123456 /add
    3⤵
    PID:752
- C:\Windows\SysWOW64\net.exe
  net localgroup administrators zuimeng /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 localgroup administrators zuimeng /add
    3⤵
    PID:692

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ac8855 /state1:0x41c64e6d
1⤵
- Modifies WinLogon to allow AutoLogon
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3884