0c9d0d20f3ef087ae8c0a9b0d5dd162cb7691e48cadb21156b789328276ae4bd

Analysis

max time kernel
35s
max time network
37s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
08/07/2023, 10:30

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

6f1693e0a04167exeexeexeex.exe
Size

64KB
MD5

6f1693e0a04167067211b037a74a681a
SHA1

8518a5a7f8ca6c25e0a54a765ef9d6c3aeda6845
SHA256

0c9d0d20f3ef087ae8c0a9b0d5dd162cb7691e48cadb21156b789328276ae4bd
SHA512

332c8a729afc553fde8392c8c36aa7e99229897b9a7dbf1c0143b369a749478d94a2aac079d001913bd6990c4b3cd54a0ab86919f32a3376b10a11c955e62460
SSDEEP

768:dbhw4vOdxBT8/Dh3TZhQZBs4a2HBfgxHgVLqm41oe:hXOBY/pTZhSxa+SJ71oe

Score

6^/10

bootkit persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Writing to the Registry Example = "C:\\Windows\\system32\\svchose.exe"	6f1693e0a04167exeexeexeex.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\physicaldrive0	6f1693e0a04167exeexeexeex.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\svchose.exe	6f1693e0a04167exeexeexeex.exe
File opened for modification	C:\Windows\SysWOW64\svchose.exe	6f1693e0a04167exeexeexeex.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	972	shutdown.exe
Token: SeRemoteShutdownPrivilege	972	shutdown.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2088	2996	6f1693e0a04167exeexeexeex.exe	28
PID 2996 wrote to memory of 2088	2996	6f1693e0a04167exeexeexeex.exe	28
PID 2996 wrote to memory of 2088	2996	6f1693e0a04167exeexeexeex.exe	28
PID 2996 wrote to memory of 2088	2996	6f1693e0a04167exeexeexeex.exe	28
PID 2088 wrote to memory of 1264	2088	cmd.exe	30
PID 2088 wrote to memory of 1264	2088	cmd.exe	30
PID 2088 wrote to memory of 1264	2088	cmd.exe	30
PID 2088 wrote to memory of 1264	2088	cmd.exe	30
PID 1264 wrote to memory of 640	1264	net.exe	31
PID 1264 wrote to memory of 640	1264	net.exe	31
PID 1264 wrote to memory of 640	1264	net.exe	31
PID 1264 wrote to memory of 640	1264	net.exe	31
PID 2996 wrote to memory of 2092	2996	6f1693e0a04167exeexeexeex.exe	32
PID 2996 wrote to memory of 2092	2996	6f1693e0a04167exeexeexeex.exe	32
PID 2996 wrote to memory of 2092	2996	6f1693e0a04167exeexeexeex.exe	32
PID 2996 wrote to memory of 2092	2996	6f1693e0a04167exeexeexeex.exe	32
PID 2092 wrote to memory of 972	2092	cmd.exe	34
PID 2092 wrote to memory of 972	2092	cmd.exe	34
PID 2092 wrote to memory of 972	2092	cmd.exe	34
PID 2092 wrote to memory of 972	2092	cmd.exe	34

C:\Users\Admin\AppData\Local\Temp\6f1693e0a04167exeexeexeex.exe
"C:\Users\Admin\AppData\Local\Temp\6f1693e0a04167exeexeexeex.exe"
1⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c net user administrator 123
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2088
- - C:\Windows\SysWOW64\net.exe
    net user administrator 123
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user administrator 123
      4⤵
      PID:640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c shutdown -r
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown -r
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:972

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2080

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-55-0x00000000027C0000-0x00000000027C1000-memory.dmp

Filesize
4KB

Download
memory/2208-56-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download