Analysis
-
max time kernel
14s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-06-2023 19:12
Behavioral task
behavioral1
Sample
3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe
Resource
win10v2004-20230221-en
Errors
General
-
Target
3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe
-
Size
2.4MB
-
MD5
3bb2b1c4254e25f4e1ef4aed9308b870
-
SHA1
493504127b9cf900b48a3291109a267033521b2a
-
SHA256
3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341
-
SHA512
73a4f5d7208860fc031bb674135c54b6f811d9e8b5dc608bbbcaddb448f037f49a47fb14ad7acd649b715bc7aadedcf4ba9765580d756f29a417b854678091ee
-
SSDEEP
49152:wTM4SOLo3LIX4SlVR9mPU+dOoNSkabUOjaehq4CbVc3nLvu78Rb/4Vg:wTM4SOLc24E8M+G/h+ecH5cXjuYRb/4
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exedescription ioc process File opened for modification \??\PhysicalDrive0 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe -
Processes:
3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
Processes:
3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exepid process 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe -
Suspicious use of AdjustPrivilegeToken 44 IoCs
Processes:
WMIC.exe3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exedescription pid process Token: SeIncreaseQuotaPrivilege 988 WMIC.exe Token: SeSecurityPrivilege 988 WMIC.exe Token: SeTakeOwnershipPrivilege 988 WMIC.exe Token: SeLoadDriverPrivilege 988 WMIC.exe Token: SeSystemProfilePrivilege 988 WMIC.exe Token: SeSystemtimePrivilege 988 WMIC.exe Token: SeProfSingleProcessPrivilege 988 WMIC.exe Token: SeIncBasePriorityPrivilege 988 WMIC.exe Token: SeCreatePagefilePrivilege 988 WMIC.exe Token: SeBackupPrivilege 988 WMIC.exe Token: SeRestorePrivilege 988 WMIC.exe Token: SeShutdownPrivilege 988 WMIC.exe Token: SeDebugPrivilege 988 WMIC.exe Token: SeSystemEnvironmentPrivilege 988 WMIC.exe Token: SeRemoteShutdownPrivilege 988 WMIC.exe Token: SeUndockPrivilege 988 WMIC.exe Token: SeManageVolumePrivilege 988 WMIC.exe Token: 33 988 WMIC.exe Token: 34 988 WMIC.exe Token: 35 988 WMIC.exe Token: SeIncreaseQuotaPrivilege 988 WMIC.exe Token: SeSecurityPrivilege 988 WMIC.exe Token: SeTakeOwnershipPrivilege 988 WMIC.exe Token: SeLoadDriverPrivilege 988 WMIC.exe Token: SeSystemProfilePrivilege 988 WMIC.exe Token: SeSystemtimePrivilege 988 WMIC.exe Token: SeProfSingleProcessPrivilege 988 WMIC.exe Token: SeIncBasePriorityPrivilege 988 WMIC.exe Token: SeCreatePagefilePrivilege 988 WMIC.exe Token: SeBackupPrivilege 988 WMIC.exe Token: SeRestorePrivilege 988 WMIC.exe Token: SeShutdownPrivilege 988 WMIC.exe Token: SeDebugPrivilege 988 WMIC.exe Token: SeSystemEnvironmentPrivilege 988 WMIC.exe Token: SeRemoteShutdownPrivilege 988 WMIC.exe Token: SeUndockPrivilege 988 WMIC.exe Token: SeManageVolumePrivilege 988 WMIC.exe Token: 33 988 WMIC.exe Token: 34 988 WMIC.exe Token: 35 988 WMIC.exe Token: SeShutdownPrivilege 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe Token: SeShutdownPrivilege 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe Token: SeShutdownPrivilege 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe Token: SeShutdownPrivilege 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exepid process 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.execmd.exedescription pid process target process PID 2008 wrote to memory of 1704 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe cmd.exe PID 2008 wrote to memory of 1704 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe cmd.exe PID 2008 wrote to memory of 1704 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe cmd.exe PID 2008 wrote to memory of 1704 2008 3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe cmd.exe PID 1704 wrote to memory of 988 1704 cmd.exe WMIC.exe PID 1704 wrote to memory of 988 1704 cmd.exe WMIC.exe PID 1704 wrote to memory of 988 1704 cmd.exe WMIC.exe PID 1704 wrote to memory of 988 1704 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe"C:\Users\Admin\AppData\Local\Temp\3edb328be542257dafc2ff1d4c726b602abf9ae87af8e82712c74df90202f341.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic path Win32_ComputerSystemProduct get uuid /value2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path Win32_ComputerSystemProduct get uuid /value3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1896-64-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/2008-54-0x0000000000400000-0x0000000000744000-memory.dmpFilesize
3.3MB
-
memory/2008-55-0x0000000000400000-0x0000000000744000-memory.dmpFilesize
3.3MB
-
memory/2008-56-0x0000000000400000-0x0000000000744000-memory.dmpFilesize
3.3MB
-
memory/2008-57-0x0000000000400000-0x0000000000744000-memory.dmpFilesize
3.3MB