bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9

Reason

Machine shutdown

General

Target

bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
Size

17KB
MD5

1f54db8e2133f535609b3eda1db7d869
SHA1

32a038fd9fc7acca9886e54c860949d0b3a93599
SHA256

bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9
SHA512

df62fe3f0c5178dc69b1db65c2ae8a5f062f5443e4cc2a26735a38d0ee38c38483add46ae2627d23d8a28b4fdabbbea792d6a1f785c949326e292f75db079d4b
SSDEEP

384:/AhgmZnWs/FBSPGvBm/Qbw7gZTErM/JtnObH0/RtDlFjBsEu:/2gB7GpmaH/JQL0/rC

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

x2z8.exex2z8.exe

pid process

3068 x2z8.exe
3380 x2z8.exe

pid	process
3068	x2z8.exe
3380	x2z8.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/372-132-0x0000000000400000-0x0000000000411000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\x2z8.exe	upx
C:\Users\Admin\AppData\Local\Temp\x2z8.exe	upx
behavioral2/memory/3068-140-0x0000000000400000-0x0000000000411000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\x2z8.exe	upx

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exex2z8.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
File opened for modification	\??\PHYSICALDRIVE0	x2z8.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exex2z8.exe

description	pid	process	target process
PID 372 set thread context of 3972	372	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 3068 set thread context of 3380	3068	x2z8.exe	x2z8.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "223"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

x2z8.exe

description pid process

Token: SeShutdownPrivilege 3380 x2z8.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

456 LogonUI.exe

description	pid	process
Token: SeShutdownPrivilege	3380	x2z8.exe

pid	process
456	LogonUI.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exebd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exex2z8.exe

description	pid	process	target process
PID 372 wrote to memory of 3972	372	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 372 wrote to memory of 3972	372	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 372 wrote to memory of 3972	372	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 372 wrote to memory of 3972	372	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 372 wrote to memory of 3972	372	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 372 wrote to memory of 3972	372	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 372 wrote to memory of 3972	372	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
PID 3972 wrote to memory of 3068	3972	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	x2z8.exe
PID 3972 wrote to memory of 3068	3972	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	x2z8.exe
PID 3972 wrote to memory of 3068	3972	bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe	x2z8.exe
PID 3068 wrote to memory of 3380	3068	x2z8.exe	x2z8.exe
PID 3068 wrote to memory of 3380	3068	x2z8.exe	x2z8.exe
PID 3068 wrote to memory of 3380	3068	x2z8.exe	x2z8.exe
PID 3068 wrote to memory of 3380	3068	x2z8.exe	x2z8.exe
PID 3068 wrote to memory of 3380	3068	x2z8.exe	x2z8.exe
PID 3068 wrote to memory of 3380	3068	x2z8.exe	x2z8.exe
PID 3068 wrote to memory of 3380	3068	x2z8.exe	x2z8.exe

C:\Users\Admin\AppData\Local\Temp\bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
"C:\Users\Admin\AppData\Local\Temp\bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:372

C:\Users\Admin\AppData\Local\Temp\bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
C:\Users\Admin\AppData\Local\Temp\bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9.exe
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:3972

C:\Users\Admin\AppData\Local\Temp\x2z8.exe
C:\Users\Admin\AppData\Local\Temp\\x2z8.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3068

C:\Users\Admin\AppData\Local\Temp\x2z8.exe
C:\Users\Admin\AppData\Local\Temp\x2z8.exe
4⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:3380

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39ef055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:456

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fpath.txt
Filesize
102B

MD5
3afbf70daa7e058bea4db2e3a2ad36c4

SHA1
748df8998d66d59d4277c8b1e1b8e729bd14f694

SHA256
03a7b531eced0db2b1960d8ae4271829912b2fe3a4d4519358995cc299042d36

SHA512
14524f55f1defadc8da6c3d9ccffffeb99de9647eb88d3bbcbf60fa9d19a4ad61052c7808c1fd40027d9b6291c59ad643e444bbe27d953464e78b0da455651d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\x2z8.exe
Filesize
17KB

MD5
1f54db8e2133f535609b3eda1db7d869

SHA1
32a038fd9fc7acca9886e54c860949d0b3a93599

SHA256
bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9

SHA512
df62fe3f0c5178dc69b1db65c2ae8a5f062f5443e4cc2a26735a38d0ee38c38483add46ae2627d23d8a28b4fdabbbea792d6a1f785c949326e292f75db079d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\x2z8.exe
Filesize
17KB

MD5
1f54db8e2133f535609b3eda1db7d869

SHA1
32a038fd9fc7acca9886e54c860949d0b3a93599

SHA256
bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9

SHA512
df62fe3f0c5178dc69b1db65c2ae8a5f062f5443e4cc2a26735a38d0ee38c38483add46ae2627d23d8a28b4fdabbbea792d6a1f785c949326e292f75db079d4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\x2z8.exe
Filesize
17KB

MD5
1f54db8e2133f535609b3eda1db7d869

SHA1
32a038fd9fc7acca9886e54c860949d0b3a93599

SHA256
bd3cf8dbf50c46c72d1b512d9a0185d8127e0e3a8735d93bf87fdf0a5843c7c9

SHA512
df62fe3f0c5178dc69b1db65c2ae8a5f062f5443e4cc2a26735a38d0ee38c38483add46ae2627d23d8a28b4fdabbbea792d6a1f785c949326e292f75db079d4b

Download Submit
memory/372-132-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3068-136-0x0000000000000000-mapping.dmp

Download
memory/3068-140-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3380-141-0x0000000000000000-mapping.dmp

Download
memory/3380-146-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3972-133-0x0000000000000000-mapping.dmp

Download
memory/3972-134-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download
memory/3972-139-0x0000000000400000-0x0000000000404000-memory.dmp

Filesize
16KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads