d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9

Reason

Machine shutdown

General

Target

d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9.exe
Size

10KB
MD5

6a45b1b99472199f8ba3b07547fce7f5
SHA1

ce68084f7fc3c27dcf6916ee7bfc14a1e03c34ff
SHA256

d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9
SHA512

3ee03cd46b8838c7ad90f054e29f527b5236299758d419cb2a611ecde449fd86fcf8f603b891ececad6a596055252e9335e8fde04ea06d8622ed6ad664012751
SSDEEP

96:ylNrqC4RquUqCLm8ClTckBcf0hKMqizUWkQHvCqw:6rqvqucLm8CrcchKMqi+QPCqw

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

sys3.exe

pid process

1984 sys3.exe

pid	process
1984	sys3.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9.exesys3.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9.exe
File opened for modification	\??\PHYSICALDRIVE0	sys3.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "223"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

sys3.exe

description pid process

Token: SeShutdownPrivilege 1984 sys3.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

2332 LogonUI.exe

description	pid	process
Token: SeShutdownPrivilege	1984	sys3.exe

pid	process
2332	LogonUI.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9.exe

description	pid	process	target process
PID 3736 wrote to memory of 1984	3736	d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9.exe	sys3.exe
PID 3736 wrote to memory of 1984	3736	d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9.exe	sys3.exe
PID 3736 wrote to memory of 1984	3736	d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9.exe	sys3.exe

C:\Users\Admin\AppData\Local\Temp\d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9.exe
"C:\Users\Admin\AppData\Local\Temp\d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:3736

C:\Users\Admin\AppData\Local\Temp\sys3.exe
C:\Users\Admin\AppData\Local\Temp\\sys3.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3985055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\sys3.exe

Filesize
10KB

MD5
6a45b1b99472199f8ba3b07547fce7f5

SHA1
ce68084f7fc3c27dcf6916ee7bfc14a1e03c34ff

SHA256
d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9

SHA512
3ee03cd46b8838c7ad90f054e29f527b5236299758d419cb2a611ecde449fd86fcf8f603b891ececad6a596055252e9335e8fde04ea06d8622ed6ad664012751

Download Submit
C:\Users\Admin\AppData\Local\Temp\sys3.exe

Filesize
10KB

MD5
6a45b1b99472199f8ba3b07547fce7f5

SHA1
ce68084f7fc3c27dcf6916ee7bfc14a1e03c34ff

SHA256
d6b06fa804cd7cf54ec18ab4eac689eb17c44c5a1f3bedf906c7a9e89b3a02d9

SHA512
3ee03cd46b8838c7ad90f054e29f527b5236299758d419cb2a611ecde449fd86fcf8f603b891ececad6a596055252e9335e8fde04ea06d8622ed6ad664012751

Download Submit
C:\Users\Admin\AppData\Local\Temp\systm.txt

Filesize
102B

MD5
993d16d5a1fa4fc3a1d20373839d56a7

SHA1
76aaac1ac75e30f17a49372a8aaa9ecc23350918

SHA256
235e7ea3036cc8a273ad4aecaba07b05380f1ae9bda07ac5bf7046dc16391984

SHA512
8a23d4b5201d6c8fd680daab0d3b78f5ab58c160f74ff2a780f483232febb70c3db52a8515c0bffa9427f94e600765844069e36ebc487bb708864dce1a64118b

Download Submit
memory/1984-133-0x0000000000000000-mapping.dmp

Download
memory/3736-132-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads