7e5296fe1e1ac15e1240fb9b455fde16a4d46e2e4ae5c52061b91994a7988b21

Analysis

max time kernel
20s
max time network
26s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
23/07/2023, 03:39

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

VLauncher.exe
Size

39.4MB
MD5

bf9bfbf49335037aeede6416c4bdecce
SHA1

1d0e0051bced999c4f44fd1e3481af2cd972fc90
SHA256

7e5296fe1e1ac15e1240fb9b455fde16a4d46e2e4ae5c52061b91994a7988b21
SHA512

19fbc7d006e937feac2cfba6345d82c62125a0bdf97874add4d8fb55a7d283d47777ad70a36a34f651db546f6aab68f3fcffb52142a04b86c04315e679ebe4e0
SSDEEP

786432:P2L20eJQFpXZrBqvueV68RDfn8ZtkW9eZlj9hwXhSqfYMjzsYGr9k+WDnS4Va:P2LUJQFpNBijJ8ZtkW4j9hwQDMjwBkTN

Score

10^/10

bootkit persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = " "	VLauncher.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	VLauncher.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 13 IoCs

evasion

pid	Process
2436	taskkill.exe
2764	taskkill.exe
3008	taskkill.exe
2064	taskkill.exe
2160	taskkill.exe
2156	taskkill.exe
2720	taskkill.exe
2216	taskkill.exe
548	taskkill.exe
836	taskkill.exe
564	taskkill.exe
1504	taskkill.exe
2032	taskkill.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2436	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	2156	taskkill.exe
Token: SeDebugPrivilege	2720	taskkill.exe
Token: SeDebugPrivilege	2216	taskkill.exe
Token: SeDebugPrivilege	548	taskkill.exe
Token: SeDebugPrivilege	836	taskkill.exe
Token: SeDebugPrivilege	564	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	1504	taskkill.exe
Token: SeDebugPrivilege	2160	taskkill.exe
Token: SeDebugPrivilege	2064	taskkill.exe
Token: SeShutdownPrivilege	2008	shutdown.exe
Token: SeRemoteShutdownPrivilege	2008	shutdown.exe
Token: SeDebugPrivilege	2032	taskkill.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2436	2240	VLauncher.exe	28
PID 2240 wrote to memory of 2436	2240	VLauncher.exe	28
PID 2240 wrote to memory of 2436	2240	VLauncher.exe	28
PID 2240 wrote to memory of 2764	2240	VLauncher.exe	31
PID 2240 wrote to memory of 2764	2240	VLauncher.exe	31
PID 2240 wrote to memory of 2764	2240	VLauncher.exe	31
PID 2240 wrote to memory of 2156	2240	VLauncher.exe	33
PID 2240 wrote to memory of 2156	2240	VLauncher.exe	33
PID 2240 wrote to memory of 2156	2240	VLauncher.exe	33
PID 2240 wrote to memory of 2720	2240	VLauncher.exe	35
PID 2240 wrote to memory of 2720	2240	VLauncher.exe	35
PID 2240 wrote to memory of 2720	2240	VLauncher.exe	35
PID 2240 wrote to memory of 2216	2240	VLauncher.exe	37
PID 2240 wrote to memory of 2216	2240	VLauncher.exe	37
PID 2240 wrote to memory of 2216	2240	VLauncher.exe	37
PID 2240 wrote to memory of 548	2240	VLauncher.exe	39
PID 2240 wrote to memory of 548	2240	VLauncher.exe	39
PID 2240 wrote to memory of 548	2240	VLauncher.exe	39
PID 2240 wrote to memory of 836	2240	VLauncher.exe	41
PID 2240 wrote to memory of 836	2240	VLauncher.exe	41
PID 2240 wrote to memory of 836	2240	VLauncher.exe	41
PID 2240 wrote to memory of 564	2240	VLauncher.exe	43
PID 2240 wrote to memory of 564	2240	VLauncher.exe	43
PID 2240 wrote to memory of 564	2240	VLauncher.exe	43
PID 2240 wrote to memory of 3008	2240	VLauncher.exe	45
PID 2240 wrote to memory of 3008	2240	VLauncher.exe	45
PID 2240 wrote to memory of 3008	2240	VLauncher.exe	45
PID 2240 wrote to memory of 1504	2240	VLauncher.exe	47
PID 2240 wrote to memory of 1504	2240	VLauncher.exe	47
PID 2240 wrote to memory of 1504	2240	VLauncher.exe	47
PID 2240 wrote to memory of 2160	2240	VLauncher.exe	49
PID 2240 wrote to memory of 2160	2240	VLauncher.exe	49
PID 2240 wrote to memory of 2160	2240	VLauncher.exe	49
PID 2240 wrote to memory of 2064	2240	VLauncher.exe	51
PID 2240 wrote to memory of 2064	2240	VLauncher.exe	51
PID 2240 wrote to memory of 2064	2240	VLauncher.exe	51
PID 2240 wrote to memory of 2008	2240	VLauncher.exe	53
PID 2240 wrote to memory of 2008	2240	VLauncher.exe	53
PID 2240 wrote to memory of 2008	2240	VLauncher.exe	53
PID 2240 wrote to memory of 2032	2240	VLauncher.exe	57
PID 2240 wrote to memory of 2032	2240	VLauncher.exe	57
PID 2240 wrote to memory of 2032	2240	VLauncher.exe	57

C:\Users\Admin\AppData\Local\Temp\VLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\VLauncher.exe"
1⤵
- Modifies WinLogon for persistence
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2436
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2156
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2720
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2216
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:836
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:564
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3008
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2160
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2064
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /t 0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2008
- C:\Windows\system32\taskkill.exe
  taskkill /F /IM taskmgr.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2032

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1704

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1704-60-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/2240-54-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download
memory/2240-55-0x000000013F5C0000-0x0000000141D24000-memory.dmp

Filesize
39.4MB

Download
memory/2240-56-0x000000001B080000-0x000000001B100000-memory.dmp

Filesize
512KB

Download
memory/2240-57-0x000000001B080000-0x000000001B100000-memory.dmp

Filesize
512KB

Download
memory/2240-58-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download
memory/2240-59-0x000000001B080000-0x000000001B100000-memory.dmp

Filesize
512KB

Download
memory/2240-61-0x000007FEF54C0000-0x000007FEF5EAC000-memory.dmp

Filesize
9.9MB

Download
memory/2864-62-0x00000000026E0000-0x00000000026E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads