Overview
overview
10Static
static
10Malware-da...00.exe
windows7-x64
Malware-da...00.exe
windows10-2004-x64
Malware-da...ws.exe
windows7-x64
6Malware-da...ws.exe
windows10-2004-x64
6Malware-da...as.exe
windows7-x64
1Malware-da...as.exe
windows10-2004-x64
1Malware-da...ck.exe
windows7-x64
1Malware-da...ck.exe
windows10-2004-x64
1Malware-da...V2.exe
windows7-x64
10Malware-da...V2.exe
windows10-2004-x64
10Malware-da...er.exe
windows7-x64
1Malware-da...er.exe
windows10-2004-x64
1Malware-da...an.exe
windows7-x64
1Malware-da...an.exe
windows10-2004-x64
1Malware-da...up.exe
windows7-x64
1Malware-da...up.exe
windows10-2004-x64
1Malware-da...nt.exe
windows7-x64
Malware-da...nt.exe
windows10-2004-x64
Malware-da...ye.exe
windows7-x64
Malware-da...ye.exe
windows10-2004-x64
Malware-da...ry.exe
windows7-x64
10Malware-da...ry.exe
windows10-2004-x64
10Malware-da...op.exe
windows7-x64
7Malware-da...op.exe
windows10-2004-x64
7Resubmissions
27-05-2024 22:11
240527-14ae9ada43 1027-05-2024 21:15
240527-z3zhbabd59 1013-02-2024 12:11
240213-pcwzdshd2w 1013-02-2024 12:08
240213-pa6qtahc7y 1018-12-2023 08:13
231218-j4g2nabaf5 1005-12-2023 08:54
231205-kt32taae27 1005-12-2023 07:41
231205-jjdthahh6w 1005-12-2023 07:38
231205-jgmcvshh5x 1026-11-2023 09:39
231126-lmxf5agd87 10Analysis
-
max time kernel
11s -
max time network
17s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
05-12-2023 07:41
Behavioral task
behavioral1
Sample
Malware-database-main/000.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
Malware-database-main/000.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral3
Sample
Malware-database-main/ChilledWindows.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
Malware-database-main/ChilledWindows.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral5
Sample
Malware-database-main/Christmas.exe
Resource
win7-20231130-en
Behavioral task
behavioral6
Sample
Malware-database-main/Christmas.exe
Resource
win10v2004-20231201-en
Behavioral task
behavioral7
Sample
Malware-database-main/CookieClickerHack.exe
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
Malware-database-main/CookieClickerHack.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral9
Sample
Malware-database-main/Electron V2.exe
Resource
win7-20231130-en
Behavioral task
behavioral10
Sample
Malware-database-main/Electron V2.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral11
Sample
Malware-database-main/Flasher.exe
Resource
win7-20231130-en
Behavioral task
behavioral12
Sample
Malware-database-main/Flasher.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral13
Sample
Malware-database-main/MEMZ Trojan.exe
Resource
win7-20231201-en
Behavioral task
behavioral14
Sample
Malware-database-main/MEMZ Trojan.exe
Resource
win10v2004-20231130-en
Behavioral task
behavioral15
Sample
Malware-database-main/Popup.exe
Resource
win7-20231201-en
Behavioral task
behavioral16
Sample
Malware-database-main/Popup.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral17
Sample
Malware-database-main/PowerPoint.exe
Resource
win7-20231023-en
Behavioral task
behavioral18
Sample
Malware-database-main/PowerPoint.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral19
Sample
Malware-database-main/RedEye.exe
Resource
win7-20231023-en
Behavioral task
behavioral20
Sample
Malware-database-main/RedEye.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral21
Sample
Malware-database-main/WannaCry.exe
Resource
win7-20231023-en
Behavioral task
behavioral22
Sample
Malware-database-main/WannaCry.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral23
Sample
Malware-database-main/butterflyondesktop.exe
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
Malware-database-main/butterflyondesktop.exe
Resource
win10v2004-20231130-en
Errors
General
-
Target
Malware-database-main/PowerPoint.exe
-
Size
136KB
-
MD5
70108103a53123201ceb2e921fcfe83c
-
SHA1
c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
-
SHA256
9c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
-
SHA512
996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
-
SSDEEP
1536:3VrdxBvcGdDHHtWv8udA1JYREgJ/qEOpsChnU4V1lyqHv4vAmOG9HSDKRppppp5B:1H5D0dSgo7ppTV1lyqPOAmOG9HSOD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
sys3.exepid process 4344 sys3.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
PowerPoint.exesys3.exedescription ioc process File opened for modification \??\PHYSICALDRIVE0 PowerPoint.exe File opened for modification \??\PHYSICALDRIVE0 sys3.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "144" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
sys3.exedescription pid process Token: SeShutdownPrivilege 4344 sys3.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
LogonUI.exepid process 4940 LogonUI.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
PowerPoint.exedescription pid process target process PID 1988 wrote to memory of 4344 1988 PowerPoint.exe sys3.exe PID 1988 wrote to memory of 4344 1988 PowerPoint.exe sys3.exe PID 1988 wrote to memory of 4344 1988 PowerPoint.exe sys3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"C:\Users\Admin\AppData\Local\Temp\Malware-database-main\PowerPoint.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\sys3.exeC:\Users\Admin\AppData\Local\Temp\\sys3.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa394c855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\sys3.exeFilesize
136KB
MD570108103a53123201ceb2e921fcfe83c
SHA1c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA2569c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
-
C:\Users\Admin\AppData\Local\Temp\sys3.exeFilesize
136KB
MD570108103a53123201ceb2e921fcfe83c
SHA1c71799a6a6d09ee758b04cdf90a4ab76fbd2a7e3
SHA2569c3f8df80193c085912c9950c58051ae77c321975784cc069ceacd4f57d5861d
SHA512996701c65eee7f781c2d22dce63f4a95900f36b97a99dcf833045bce239a08b3c2f6326b3a808431cdab92d59161dd80763e44126578e160d79b7095175d276b
-
C:\Users\Admin\AppData\Local\Temp\systm.txtFilesize
70B
MD589f10072ebabf67c196f4c140e5b5349
SHA1e36722bc9f76f6d8ba5d81d6a4db6bc6f34b9dfa
SHA256da42851c854d6a2a0cfab513537bfe4bff184f8c63a04512cf00270b8fb34877
SHA512eaa40272dd2f2df0abd171657ec0b1cf49f0a0ead48ad02f2c21550a7180cd5d4a1701596cab0fbdcff4d308edfb9ff96b2581ae089adddc2b5a410a4141af35
-
memory/1988-0-0x000000002AA00000-0x000000002AA24000-memory.dmpFilesize
144KB
-
memory/1988-7-0x000000002AA00000-0x000000002AA24000-memory.dmpFilesize
144KB