13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7

Analysis

max time kernel
121s
max time network
145s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 15:35

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe
Size

1.7MB
MD5

f88430dd51bb0076e36479d9d6419d11
SHA1

4ceb5ea07b2f014bfa77c309341dae4a5829f69f
SHA256

13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7
SHA512

f9df0401af6a44f1186142227fcb509a57385c62f351502af528828d7bdfe6f2d284b0bc0325232a9df2982956bc78579e2d3f2eea559d46477b965ea86706db
SSDEEP

24576:+eC1s1AwCUZP9Te9TIkTTZaqdiXSp0c02uFG6dAk3HMCc9Xtv:+N1GCUHyTIkTTZaqdwk0c05HGijcjv

Score

8^/10

bootkit evasion persistence upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000a00000001225a-2.dat	acprotect

Loads dropped DLL 1 IoCs

pid	Process
2852	13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a00000001225a-2.dat	upx
behavioral1/memory/2852-4-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2852-6-0x0000000010000000-0x000000001003D000-memory.dmp	upx
behavioral1/memory/2852-7-0x0000000010000000-0x000000001003D000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\physicaldrive0	13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1392	shutdown.exe
Token: SeRemoteShutdownPrivilege	1392	shutdown.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2852	13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe
2852	13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe
2852	13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1392	2852	13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe	29
PID 2852 wrote to memory of 1392	2852	13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe	29
PID 2852 wrote to memory of 1392	2852	13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe	29
PID 2852 wrote to memory of 1392	2852	13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe	29

C:\Users\Admin\AppData\Local\Temp\13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe
"C:\Users\Admin\AppData\Local\Temp\13e4d94c6e8f01b33747e22de13378da66dd2839e5962f635fa5cc8316f797a7.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\shutdown.exe
  shutdown.exe -s -t 60
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1392

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1160

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\SkinH_EL.dll

Filesize
86KB

MD5
147127382e001f495d1842ee7a9e7912

SHA1
92d1ed56032183c75d4b57d7ce30b1c4ae11dc9b

SHA256
edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc

SHA512
97f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d

Download Submit
memory/1160-17-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/1508-18-0x00000000028A0000-0x00000000028A1000-memory.dmp

Filesize
4KB

Download
memory/2852-4-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2852-6-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download
memory/2852-7-0x0000000010000000-0x000000001003D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads