222247618a9b4a916007666b7e1911a36890b40b46a6231fe0356c43bcfd04f6

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7v20210408
submitted
09-07-2021 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

REG.BR1.OMUGSUHGFCUERBQAJSZUPYIGQIMJSPÊ.msi
Size

282KB
MD5

7cc4b16624dada727a8ea786ba38d180
SHA1

fba91a526dfdba7c49a337beed687fba59b4157f
SHA256

222247618a9b4a916007666b7e1911a36890b40b46a6231fe0356c43bcfd04f6
SHA512

3c58d9f8c255a75e2a9b5fa1e777b5b5517050a106ec512da3c5ab10ab6e0d292bc4eddb42105e86286ccffa75cf0727d7c0236db993c21539f408b29de50adf

Score

9^/10

bootkit evasion persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 1 IoCs

Processes:

MsiExec.exe

flow pid process

3 1940 MsiExec.exe
Executes dropped EXE 1 IoCs

Processes:

YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

pid process

1680 YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

flow	pid	process
3	1940	MsiExec.exe

pid	process
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

Drops startup file 1 IoCs

Processes:

MsiExec.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FDDZWBQFEA.lnk MsiExec.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FDDZWBQFEA.lnk	MsiExec.exe

Loads dropped DLL 6 IoCs

Processes:

MsiExec.exepowershell.exeYOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

pid	process
1940	MsiExec.exe
1940	MsiExec.exe
884	powershell.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\Avira.OE.NativeCore.dll	themida
\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\Avira.OE.NativeCore.dll	themida
behavioral1/memory/1680-107-0x000000006D000000-0x000000006F292000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

MsiExec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\software\Microsoft\Windows\CurrentVersion\Run	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\FDDZWBQFEA = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\FDDZWBQFEA.lnk"	MsiExec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

6 ipinfo.io
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

flow	ioc
6	ipinfo.io

description	ioc	process
File opened for modification	\??\PhysicalDrive0	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

pid process

1680 YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

pid	process
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

Drops file in Windows directory 8 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIC1CB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f74bc01.ipi	msiexec.exe
File created	C:\Windows\Installer\f74bbff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\f74bbff.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBCF9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBF98.tmp	msiexec.exe
File created	C:\Windows\Installer\f74bc01.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exepowershell.exeYOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

pid	process
1444	msiexec.exe
1444	msiexec.exe
884	powershell.exe
884	powershell.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

pid process

1680 YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

pid	process
1680	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

msiexec.exemsiexec.exepowershell.exe

description	pid	process
Token: SeShutdownPrivilege	1932	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1932	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeSecurityPrivilege	1444	msiexec.exe
Token: SeCreateTokenPrivilege	1932	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1932	msiexec.exe
Token: SeLockMemoryPrivilege	1932	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1932	msiexec.exe
Token: SeMachineAccountPrivilege	1932	msiexec.exe
Token: SeTcbPrivilege	1932	msiexec.exe
Token: SeSecurityPrivilege	1932	msiexec.exe
Token: SeTakeOwnershipPrivilege	1932	msiexec.exe
Token: SeLoadDriverPrivilege	1932	msiexec.exe
Token: SeSystemProfilePrivilege	1932	msiexec.exe
Token: SeSystemtimePrivilege	1932	msiexec.exe
Token: SeProfSingleProcessPrivilege	1932	msiexec.exe
Token: SeIncBasePriorityPrivilege	1932	msiexec.exe
Token: SeCreatePagefilePrivilege	1932	msiexec.exe
Token: SeCreatePermanentPrivilege	1932	msiexec.exe
Token: SeBackupPrivilege	1932	msiexec.exe
Token: SeRestorePrivilege	1932	msiexec.exe
Token: SeShutdownPrivilege	1932	msiexec.exe
Token: SeDebugPrivilege	1932	msiexec.exe
Token: SeAuditPrivilege	1932	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1932	msiexec.exe
Token: SeChangeNotifyPrivilege	1932	msiexec.exe
Token: SeRemoteShutdownPrivilege	1932	msiexec.exe
Token: SeUndockPrivilege	1932	msiexec.exe
Token: SeSyncAgentPrivilege	1932	msiexec.exe
Token: SeEnableDelegationPrivilege	1932	msiexec.exe
Token: SeManageVolumePrivilege	1932	msiexec.exe
Token: SeImpersonatePrivilege	1932	msiexec.exe
Token: SeCreateGlobalPrivilege	1932	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeRestorePrivilege	1444	msiexec.exe
Token: SeTakeOwnershipPrivilege	1444	msiexec.exe
Token: SeDebugPrivilege	884	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

msiexec.exeMsiExec.exe

pid process

1932 msiexec.exe
1940 MsiExec.exe
1932 msiexec.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

MsiExec.exe

pid process

1940 MsiExec.exe

pid	process
1932	msiexec.exe
1940	MsiExec.exe
1932	msiexec.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

msiexec.exeMsiExec.exepowershell.exe

description	pid	process	target process
PID 1444 wrote to memory of 1940	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1940	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1940	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1940	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1940	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1940	1444	msiexec.exe	MsiExec.exe
PID 1444 wrote to memory of 1940	1444	msiexec.exe	MsiExec.exe
PID 1940 wrote to memory of 884	1940	MsiExec.exe	powershell.exe
PID 1940 wrote to memory of 884	1940	MsiExec.exe	powershell.exe
PID 1940 wrote to memory of 884	1940	MsiExec.exe	powershell.exe
PID 1940 wrote to memory of 884	1940	MsiExec.exe	powershell.exe
PID 884 wrote to memory of 1680	884	powershell.exe	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
PID 884 wrote to memory of 1680	884	powershell.exe	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
PID 884 wrote to memory of 1680	884	powershell.exe	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
PID 884 wrote to memory of 1680	884	powershell.exe	YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\REG.BR1.OMUGSUHGFCUERBQAJSZUPYIGQIMJSPÊ.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1932

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1444

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E986F43CBBDC2738B6AAA403195732F1
2⤵
- Blocklisted process makes network request
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" cd\;cd 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup';Start-Sleep -s 60;Invoke-Item 'FDDZWBQFEA.lnk'
3⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884

C:\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
"C:\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe"
4⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1680

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MSI4b98f.LOG
MD5
22c1ee1699b7449dbee11394a1728b89

SHA1
19000d161b0348f7228d7b993118cbbe247abbbc

SHA256
67e96e52df0e7364bce3ae7d7f092519fa5bc44fe6780e80a10f0e86bfe87550

SHA512
3568d882892494b5369173051127d6eeb80bd538d9275220046ed4860b606bdfe353a32ef2e15628e41d48fa10b3ee6c4c1094f8a76b8e9f5030a68d7cd914b3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FDDZWBQFEA.lnk
MD5
6a1cdb34ff414c0293bf77d7d5fb787e

SHA1
334e677d840e985a49f14155bed1c76fb9ac3a39

SHA256
eaf33544b57ca937aa1562f8347cfdaf477b4bc93e62bf1b9143ce8cd82c6911

SHA512
3fe8b1d3fe8166017b7ea2875411816ed1170bdb0975649dc356e5fbc50e1a8c1275189c9e37692f92cbbe70eb90accad6d372b59553a30b6461fedfc6534ffa

Download Submit
C:\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\Avira.OE.NativeCore.dll
MD5
5ceb021a1a60512382e52ea5f1033c87

SHA1
4821c22b1a416509bb4859e8f6c3d6c149fd731e

SHA256
345afbcacb45218de9d35b7d536dfabe5e0ab21bb52d81f7c5ff115fbcdfa71c

SHA512
3db11e1b3b51972153b6b5311e4b055b9b4a1be0c530840d4ff2aa2ba91c4db95c5336ebed5b791d44fedcdc441040f114b7a27ead74e87ead09997a152d9ee2

Download Submit
C:\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\MSVCP120.dll
MD5
fd5cabbe52272bd76007b68186ebaf00

SHA1
efd1e306c1092c17f6944cc6bf9a1bfad4d14613

SHA256
87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

SHA512
1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

Download Submit
C:\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\MSVCR120.dll
MD5
034ccadc1c073e4216e9466b720f9849

SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

Download Submit
C:\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
MD5
8cbb75febfb4b0b7c3b6d3613386220c

SHA1
ba5493b08354aee85151b7bbd15150a1c3f03d1d

SHA256
f495d7c5c98457febc42ec96a959293788f6915e4245899d3bb1808ab84f0d9a

SHA512
8cb5f08f9e21fb6648f364869366ad09908be9e0317f95708a9e1931d30855cdfab199464bf5d72675bc1e166e8ce4645e6d0dca0d8d1c78428fbc77d4dd25fd

Download Submit
C:\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
MD5
8cbb75febfb4b0b7c3b6d3613386220c

SHA1
ba5493b08354aee85151b7bbd15150a1c3f03d1d

SHA256
f495d7c5c98457febc42ec96a959293788f6915e4245899d3bb1808ab84f0d9a

SHA512
8cb5f08f9e21fb6648f364869366ad09908be9e0317f95708a9e1931d30855cdfab199464bf5d72675bc1e166e8ce4645e6d0dca0d8d1c78428fbc77d4dd25fd

Download Submit
C:\Windows\Installer\MSIBCF9.tmp
MD5
5c5bef05b6f3806106f8f3ce13401cc1

SHA1
6005fbe17f6e917ac45317552409d7a60976db14

SHA256
f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437

SHA512
97933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797

Download Submit
C:\Windows\Installer\MSIBF98.tmp
MD5
5c5bef05b6f3806106f8f3ce13401cc1

SHA1
6005fbe17f6e917ac45317552409d7a60976db14

SHA256
f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437

SHA512
97933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797

Download Submit
\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\Avira.OE.NativeCore.dll
MD5
1367eb9ea93bdc43a093650e39761e5f

SHA1
d2c5a69b6644e8d848596e8207eb073874133a65

SHA256
6b5c9df7dafad1782a97a954595fb868838f99efea99fd9876c269e0c848d684

SHA512
a05fa2a97785f26fee1cb26de524e4a958c3d333152225e32bedab89a6ed8c1c52695d9ca9308389affc603108cf2b9c258734aa0ae5f8e20b4ecec505a812ef

Download Submit
\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\YOWEEWICZVTJWPFCDFMPTNTOUBBCDERPIOFÉ.exe
MD5
8cbb75febfb4b0b7c3b6d3613386220c

SHA1
ba5493b08354aee85151b7bbd15150a1c3f03d1d

SHA256
f495d7c5c98457febc42ec96a959293788f6915e4245899d3bb1808ab84f0d9a

SHA512
8cb5f08f9e21fb6648f364869366ad09908be9e0317f95708a9e1931d30855cdfab199464bf5d72675bc1e166e8ce4645e6d0dca0d8d1c78428fbc77d4dd25fd

Download Submit
\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\msvcp120.dll
MD5
fd5cabbe52272bd76007b68186ebaf00

SHA1
efd1e306c1092c17f6944cc6bf9a1bfad4d14613

SHA256
87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

SHA512
1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

Download Submit
\Users\Public\Downloads\ZLOUKVSUDANYAWWPXXZF\msvcr120.dll
MD5
034ccadc1c073e4216e9466b720f9849

SHA1
f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

SHA256
86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

SHA512
5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

Download Submit
\Windows\Installer\MSIBCF9.tmp
MD5
5c5bef05b6f3806106f8f3ce13401cc1

SHA1
6005fbe17f6e917ac45317552409d7a60976db14

SHA256
f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437

SHA512
97933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797

Download Submit
\Windows\Installer\MSIBF98.tmp
MD5
5c5bef05b6f3806106f8f3ce13401cc1

SHA1
6005fbe17f6e917ac45317552409d7a60976db14

SHA256
f2f3ae8ca06f5cf320ca1d234a623bf55cf2b84c1d6dea3d85d5392e29aaf437

SHA512
97933227b6002127385ace025f85a26358e47ee79c883f03180d474c15dbaf28a88492c8e53aefc0d305872edd27db0b4468da13e6f0337988f58d2ee35fd797

Download Submit
memory/884-84-0x0000000005720000-0x0000000005721000-memory.dmp

Filesize
4KB

Download
memory/884-71-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/884-85-0x00000000057A0000-0x00000000057A1000-memory.dmp

Filesize
4KB

Download
memory/884-92-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/884-93-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/884-94-0x00000000062B0000-0x00000000062B1000-memory.dmp

Filesize
4KB

Download
memory/884-79-0x0000000005620000-0x0000000005621000-memory.dmp

Filesize
4KB

Download
memory/884-76-0x0000000005250000-0x0000000005251000-memory.dmp

Filesize
4KB

Download
memory/884-75-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/884-69-0x0000000000000000-mapping.dmp

Download
memory/884-74-0x00000000047A2000-0x00000000047A3000-memory.dmp

Filesize
4KB

Download
memory/884-73-0x00000000047A0000-0x00000000047A1000-memory.dmp

Filesize
4KB

Download
memory/884-72-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/1680-98-0x0000000000000000-mapping.dmp

Download
memory/1680-107-0x000000006D000000-0x000000006F292000-memory.dmp

Filesize
34.6MB

Download
memory/1680-108-0x000000006D001000-0x000000006D4A7000-memory.dmp

Filesize
4.6MB

Download
memory/1680-109-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1932-60-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download
memory/1940-64-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1940-63-0x0000000000000000-mapping.dmp

Download