c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
Size

3.3MB
MD5

b9f4a373a4aa3a852ea6722c3f462011
SHA1

bf4cf7921dec1fc92c6af17c9cb9e3b6c5020579
SHA256

c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff
SHA512

9a987c2b95a20fe6df2cae639057597d9f6387eb8157c33cb056e19b98215173d347c40fdf79ccd5e36b90fba71a1c1723cc955318fca62ae65e3da625e17e29
SSDEEP

98304:lJv4YWT4keGE1BVEFBna2R1RBrEw5aV+X9NjVtCD:lJv4Ye4kqVEFBna2pBowz

Score

7^/10

bootkit persistence vmprotect

Malware Config

Signatures

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/4424-1-0x0000000000400000-0x0000000000C56000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\2229298842\198670374.pri	LogonUI.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4360	4424	WerFault.exe	84

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "114"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
Token: SeShutdownPrivilege	4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
Token: SeShutdownPrivilege	4972	LogonUI.exe
Token: SeCreatePagefilePrivilege	4972	LogonUI.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4424	c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
4972	LogonUI.exe
4972	LogonUI.exe

C:\Users\Admin\AppData\Local\Temp\c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe
"C:\Users\Admin\AppData\Local\Temp\c8ae6d4acbcc5e97f7a2a67e7ea2f6e2efb4bdd1b46ccd92f4e109a6610c5eff.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4424
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 3232
  2⤵
  - Program crash
  PID:4360

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39bc055 /state1:0x41c64e6d
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4424 -ip 4424
1⤵
PID:1520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-919254492-3979293997-764407192-1000\ReadOnly\LockScreen_W\LockScreen___1280_0720_notdimmed.jpg

Filesize
1.6MB

MD5
5641512b0154d1f085a8d9c3cef434fb

SHA1
921a13d3882774d5b038a66ade62700689cbdd3c

SHA256
0b8ca78426022d8a7189dcd3e72f72988aa1a79d91d2814415d4b212af7de777

SHA512
18d703a09932dda66d20273005051a64e2c8e9b77ae9252cd0564b172a9ae539a076330aa7c17488173aad8bcf206106d339f6b224d30f7def276e181bf0f72e

Download Submit
memory/4424-7-0x00000000012A0000-0x00000000012A1000-memory.dmp

Filesize
4KB

Download
memory/4424-12-0x0000000002C70000-0x0000000002DAC000-memory.dmp

Filesize
1.2MB

Download
memory/4424-5-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download
memory/4424-6-0x0000000001290000-0x0000000001291000-memory.dmp

Filesize
4KB

Download
memory/4424-4-0x0000000001270000-0x0000000001271000-memory.dmp

Filesize
4KB

Download
memory/4424-0-0x0000000000C70000-0x0000000000C71000-memory.dmp

Filesize
4KB

Download
memory/4424-3-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/4424-1-0x0000000000400000-0x0000000000C56000-memory.dmp

Filesize
8.3MB

Download
memory/4424-13-0x0000000002C70000-0x0000000002DAC000-memory.dmp

Filesize
1.2MB

Download
memory/4424-14-0x0000000002C70000-0x0000000002DAC000-memory.dmp

Filesize
1.2MB

Download
memory/4424-15-0x0000000002C70000-0x0000000002DAC000-memory.dmp

Filesize
1.2MB

Download
memory/4424-18-0x0000000002C70000-0x0000000002DAC000-memory.dmp

Filesize
1.2MB

Download
memory/4424-176-0x0000000002C70000-0x0000000002DAC000-memory.dmp

Filesize
1.2MB

Download
memory/4424-2-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download