Overview

overview

10

Static

static

10

ฺฺฺà...ฺฺ

windows10_x64

ฺฺฺà...ฺฺ

windows10_x64

ฺฺฺà...ฺฺ

windows10_x64

8

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

7

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

1

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

8

ฺฺฺà...ฺฺ

windows10_x64

1

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

8

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

9

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

8

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

5

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

ฺฺฺà...ฺฺ

windows10_x64

10

ฺฺฺà...ฺฺ

windows10_x64

8

ฺฺฺà...ฺฺ

windows10_x64

10

Resubmissions

24-08-2023 11:16

230824-nda8msdf8z 10

05-08-2023 22:52

230805-2tn2bsfa82 10

24-07-2023 06:25

230724-g6s6laag35 10

22-07-2023 15:57

230722-tee6wabg5w 10

20-07-2023 23:19

230720-3bb5gsbf5v 10

20-07-2023 23:06

230720-23f23sba63 10

03-02-2021 11:43

210203-6bgge2nfan 10

22-11-2020 06:42

201122-6x1at779dj 10

Analysis

  • max time kernel
    17s
  • max time network
    28s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    03-02-2021 11:43

Errors

Reason
Machine shutdown

General

  • Target

    Endermanch@PowerPoint.exe

  • Size

    136KB

  • MD5

    70108103a53123201ceb2e921fcfe83c

  • SHA1

    c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3

  • SHA256

    9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d

  • SHA512

    996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Modifies WinLogon to allow AutoLogon 2 TTPs 1 IoCs

    Enables rebooting of the machine without requiring login credentials.

  • Deletes itself 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Endermanch@PowerPoint.exe
    "C:\Users\Admin\AppData\Local\Temp\Endermanch@PowerPoint.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\sys3.exe
      C:\Users\Admin\AppData\Local\Temp\\sys3.exe
      2⤵
      • Executes dropped EXE
      • Deletes itself
      • Writes to the Master Boot Record (MBR)
      • Suspicious use of AdjustPrivilegeToken
      PID:4916
  • C:\Windows\system32\LogonUI.exe
    "LogonUI.exe" /flags:0x0 /state0:0xa3ac9855 /state1:0x41c64e6d
    1⤵
    • Modifies WinLogon to allow AutoLogon
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:4976

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Winlogon Helper DLL

1
T1004

Bootkit

1
T1067

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\sys3.exe
    MD5

    70108103a53123201ceb2e921fcfe83c

    SHA1

    c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3

    SHA256

    9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d

    SHA512

    996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

  • C:\Users\Admin\AppData\Local\Temp\sys3.exe
    MD5

    70108103a53123201ceb2e921fcfe83c

    SHA1

    c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3

    SHA256

    9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d

    SHA512

    996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b

  • C:\Users\Admin\AppData\Local\Temp\systm.txt
    MD5

    ab7368e081dc109f4133ffd943c98b74

    SHA1

    1847691b3535b25f368389327543392eafd3e4fa

    SHA256

    6c2c3417ded140721c60368f64f02b4d4ed5f39b528450b75d2475da4b80c1ae

    SHA512

    e59e763b66ab716a72d3121d8a8b9b6a2dd4beb89e949202ae55ef0a1cef316d56071df8a41a587c605d1575c18f2f4f3a41d2cb174a89558722e9730a913912

  • memory/4916-2-0x0000000000000000-mapping.dmp