Analysis
-
max time kernel
86s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
13-06-2022 01:51
Static task
static1
Behavioral task
behavioral1
Sample
VAPE4.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
VAPE4.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
Errors
Reason
Machine shutdown
General
-
Target
VAPE4.exe
-
Size
37.1MB
-
MD5
c735bff65f7005656d1606bed35c8c96
-
SHA1
da017a4ab363040ab96fbbd03173e1c01319bd09
-
SHA256
afbf5da99b569974c5e8ccec0286cb4ed45401cce45b6f6c7f05a3d5565db7f0
-
SHA512
3bbae0c5c3e2e48e155e0d9eaba955285f4c086acca05d40807cf6037cf5862077878c24235805367f3a1074a715150f7bf96909c31ec5a7c5c4c2e6eff6ca51
Score
6/10
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
VAPE4.exedescription ioc process File opened for modification \??\physicaldrive0 VAPE4.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "33" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
VAPE4.exepid process 2272 VAPE4.exe 2272 VAPE4.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
VAPE4.exeAUDIODG.EXEshutdown.exeshutdown.exeshutdown.exedescription pid process Token: SeDebugPrivilege 2272 VAPE4.exe Token: 33 1832 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1832 AUDIODG.EXE Token: SeShutdownPrivilege 4516 shutdown.exe Token: SeRemoteShutdownPrivilege 4516 shutdown.exe Token: SeShutdownPrivilege 4964 shutdown.exe Token: SeRemoteShutdownPrivilege 4964 shutdown.exe Token: SeShutdownPrivilege 2268 shutdown.exe Token: SeRemoteShutdownPrivilege 2268 shutdown.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 3896 LogonUI.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
VAPE4.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2272 wrote to memory of 1436 2272 VAPE4.exe cmd.exe PID 2272 wrote to memory of 1436 2272 VAPE4.exe cmd.exe PID 2272 wrote to memory of 4336 2272 VAPE4.exe cmd.exe PID 2272 wrote to memory of 4336 2272 VAPE4.exe cmd.exe PID 4336 wrote to memory of 4516 4336 cmd.exe shutdown.exe PID 4336 wrote to memory of 4516 4336 cmd.exe shutdown.exe PID 2272 wrote to memory of 3940 2272 VAPE4.exe cmd.exe PID 2272 wrote to memory of 3940 2272 VAPE4.exe cmd.exe PID 3940 wrote to memory of 4964 3940 cmd.exe shutdown.exe PID 3940 wrote to memory of 4964 3940 cmd.exe shutdown.exe PID 2272 wrote to memory of 4564 2272 VAPE4.exe cmd.exe PID 2272 wrote to memory of 4564 2272 VAPE4.exe cmd.exe PID 4564 wrote to memory of 2268 4564 cmd.exe shutdown.exe PID 4564 wrote to memory of 2268 4564 cmd.exe shutdown.exe PID 2272 wrote to memory of 1284 2272 VAPE4.exe cmd.exe PID 2272 wrote to memory of 1284 2272 VAPE4.exe cmd.exe PID 1284 wrote to memory of 4960 1284 cmd.exe shutdown.exe PID 1284 wrote to memory of 4960 1284 cmd.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VAPE4.exe"C:\Users\Admin\AppData\Local\Temp\VAPE4.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color c12⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -s -t 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown -s -t 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -s -t 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown -s -t 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -s -t 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown -s -t 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c shutdown -s -t 02⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown -s -t 03⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x500 0x5041⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a0b055 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1284-137-0x0000000000000000-mapping.dmp
-
memory/1436-130-0x0000000000000000-mapping.dmp
-
memory/2268-136-0x0000000000000000-mapping.dmp
-
memory/3940-133-0x0000000000000000-mapping.dmp
-
memory/4336-131-0x0000000000000000-mapping.dmp
-
memory/4516-132-0x0000000000000000-mapping.dmp
-
memory/4564-135-0x0000000000000000-mapping.dmp
-
memory/4960-138-0x0000000000000000-mapping.dmp
-
memory/4964-134-0x0000000000000000-mapping.dmp