554729ae75205b4a24a3c0e22912fc09499dc4425cbb92ca0a6e55141007d3a8

Analysis

max time kernel
144s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e081d3901f30f5321c79369bbb997e0.exe
Size

12.7MB
MD5

8e081d3901f30f5321c79369bbb997e0
SHA1

7a0a80766d68c7ab38cce48159fe48a16231a2ee
SHA256

554729ae75205b4a24a3c0e22912fc09499dc4425cbb92ca0a6e55141007d3a8
SHA512

a37692f82b2a825a0291dac39aca8795f5e015655d1f4856c5fa0797add1ed788c4f83521a00e09209f0bc432af2a672bee85856af3f96c71c8cb2651e3c9582
SSDEEP

196608:9bh15jaVD7jQILCAR3wdQ4UwhwpQPoj7+f7ywxRnU1wqJ1Nk:715jsD7l3wK4UwaVGf7ywxRnUOqJ1Nk

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8e081d3901f30f5321c79369bbb997e0.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bkezjzwjmi.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8e081d3901f30f5321c79369bbb997e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8e081d3901f30f5321c79369bbb997e0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bkezjzwjmi.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bkezjzwjmi.exe

Deletes itself 1 IoCs

pid	Process
2124	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2616	bkezjzwjmi.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Wine	bkezjzwjmi.exe

Loads dropped DLL 7 IoCs

pid	Process
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe
2540	WerFault.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8e081d3901f30f5321c79369bbb997e0.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2616	bkezjzwjmi.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dmxhbvxt	8e081d3901f30f5321c79369bbb997e0.exe
File created	C:\Windows\dmxhbvxt\bkezjzwjmi.exe	8e081d3901f30f5321c79369bbb997e0.exe
File opened for modification	C:\Windows\Fonts.Lists	bkezjzwjmi.exe
File created	C:\Windows\dmxhbvxt\conf.ini	bkezjzwjmi.exe
File opened for modification	C:\Windows\dmxhbvxt\conf.ini	bkezjzwjmi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	2616	WerFault.exe	31

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2616	bkezjzwjmi.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2220	8e081d3901f30f5321c79369bbb997e0.exe
2220	8e081d3901f30f5321c79369bbb997e0.exe
2220	8e081d3901f30f5321c79369bbb997e0.exe
2220	8e081d3901f30f5321c79369bbb997e0.exe
2220	8e081d3901f30f5321c79369bbb997e0.exe
2616	bkezjzwjmi.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2596	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2596	msiexec.exe
Token: SeRestorePrivilege	1196	msiexec.exe
Token: SeTakeOwnershipPrivilege	1196	msiexec.exe
Token: SeSecurityPrivilege	1196	msiexec.exe
Token: SeCreateTokenPrivilege	2596	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2596	msiexec.exe
Token: SeLockMemoryPrivilege	2596	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2596	msiexec.exe
Token: SeMachineAccountPrivilege	2596	msiexec.exe
Token: SeTcbPrivilege	2596	msiexec.exe
Token: SeSecurityPrivilege	2596	msiexec.exe
Token: SeTakeOwnershipPrivilege	2596	msiexec.exe
Token: SeLoadDriverPrivilege	2596	msiexec.exe
Token: SeSystemProfilePrivilege	2596	msiexec.exe
Token: SeSystemtimePrivilege	2596	msiexec.exe
Token: SeProfSingleProcessPrivilege	2596	msiexec.exe
Token: SeIncBasePriorityPrivilege	2596	msiexec.exe
Token: SeCreatePagefilePrivilege	2596	msiexec.exe
Token: SeCreatePermanentPrivilege	2596	msiexec.exe
Token: SeBackupPrivilege	2596	msiexec.exe
Token: SeRestorePrivilege	2596	msiexec.exe
Token: SeShutdownPrivilege	2596	msiexec.exe
Token: SeDebugPrivilege	2596	msiexec.exe
Token: SeAuditPrivilege	2596	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2596	msiexec.exe
Token: SeChangeNotifyPrivilege	2596	msiexec.exe
Token: SeRemoteShutdownPrivilege	2596	msiexec.exe
Token: SeUndockPrivilege	2596	msiexec.exe
Token: SeSyncAgentPrivilege	2596	msiexec.exe
Token: SeEnableDelegationPrivilege	2596	msiexec.exe
Token: SeManageVolumePrivilege	2596	msiexec.exe
Token: SeImpersonatePrivilege	2596	msiexec.exe
Token: SeCreateGlobalPrivilege	2596	msiexec.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2648	2220	8e081d3901f30f5321c79369bbb997e0.exe	28
PID 2220 wrote to memory of 2648	2220	8e081d3901f30f5321c79369bbb997e0.exe	28
PID 2220 wrote to memory of 2648	2220	8e081d3901f30f5321c79369bbb997e0.exe	28
PID 2220 wrote to memory of 2596	2220	8e081d3901f30f5321c79369bbb997e0.exe	30
PID 2220 wrote to memory of 2596	2220	8e081d3901f30f5321c79369bbb997e0.exe	30
PID 2220 wrote to memory of 2596	2220	8e081d3901f30f5321c79369bbb997e0.exe	30
PID 2220 wrote to memory of 2596	2220	8e081d3901f30f5321c79369bbb997e0.exe	30
PID 2220 wrote to memory of 2596	2220	8e081d3901f30f5321c79369bbb997e0.exe	30
PID 2648 wrote to memory of 2616	2648	cmd.exe	31
PID 2648 wrote to memory of 2616	2648	cmd.exe	31
PID 2648 wrote to memory of 2616	2648	cmd.exe	31
PID 2648 wrote to memory of 2616	2648	cmd.exe	31
PID 2220 wrote to memory of 2124	2220	8e081d3901f30f5321c79369bbb997e0.exe	33
PID 2220 wrote to memory of 2124	2220	8e081d3901f30f5321c79369bbb997e0.exe	33
PID 2220 wrote to memory of 2124	2220	8e081d3901f30f5321c79369bbb997e0.exe	33
PID 2616 wrote to memory of 2540	2616	bkezjzwjmi.exe	35
PID 2616 wrote to memory of 2540	2616	bkezjzwjmi.exe	35
PID 2616 wrote to memory of 2540	2616	bkezjzwjmi.exe	35
PID 2616 wrote to memory of 2540	2616	bkezjzwjmi.exe	35

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	8e081d3901f30f5321c79369bbb997e0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	8e081d3901f30f5321c79369bbb997e0.exe

C:\Users\Admin\AppData\Local\Temp\8e081d3901f30f5321c79369bbb997e0.exe
"C:\Users\Admin\AppData\Local\Temp\8e081d3901f30f5321c79369bbb997e0.exe"
1⤵
- UAC bypass
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2220
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Windows\dmxhbvxt\bkezjzwjmi.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Windows\dmxhbvxt\bkezjzwjmi.exe
    C:\Windows\dmxhbvxt\bkezjzwjmi.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 416
      4⤵
      Loads dropped DLL
      Program crash
      PID:2540
- C:\Windows\system32\msiexec.exe
  msiexec /x {6444D213-9395-442A-A7D8-EAFEA7948BA7} /qn
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2596
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\mokill.bat" "
  2⤵
  - Deletes itself
  PID:2124

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Config.ini

Filesize
1KB

MD5
b7ed10942179d0fa1031d2f129cb23a3

SHA1
aa2d78243f7471cdee0383adb7dde3de0dd5a2d7

SHA256
1e7c54944203087bda435c1cea199e1896b0b950933980f5227cc5025cee2ee8

SHA512
4f105853cf577b3c1436b1d95df0eaacd4de04ef519608e7a5b9b19bc4d972ebfa7037ea0eec32b1e68dd72e6c4d1c1de1fb229972ca7244b6f8f62ffde2f8ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\mokill.bat

Filesize
253B

MD5
35b63538e82264b02b22e7d77af6874f

SHA1
ffe1f4655285e7b42460c1237c011e62fc91a088

SHA256
e21d199219d5d5bfa54ea6f34c97b6fc9bbb3c9b607b8442289e179a3811b278

SHA512
15eb6d22d5ca77b517c5e8aa3a946aeb8def352ab9bdcb0689ef469840906293ed3337e1a349358f9ffbcefc7f72b935a3f25b71c2a5c66cf89fa5f8fe6d4d39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1268429524-3929314613-1992311491-1000\3310a4fa6cb9c60504498d7eea986fc2_fd8337b6-73a8-46ad-be4d-21f33a14a01b

Filesize
50B

MD5
45218adff3ea5bde8a8f61987f0f458b

SHA1
cf7fffa410795cc2f7703755f0acd17b51a44ad7

SHA256
f95361b82464704675f559b13c007c9567e5914984042f537122383e747194d4

SHA512
8442cac48931075ec5bd31ea82faffc4f64d7b6845d5c477d06fc3d7eefeac1fa366b6880a85709a520a343b5dd3771e69bc4b7482cde50e69e04215927a2018

Download Submit
C:\Windows\dmxhbvxt\bkezjzwjmi.exe

Filesize
918KB

MD5
3d1c1bc12e25be579cf4641972873989

SHA1
605e641253c48db4ec07cbf716811247a9d2dca9

SHA256
3029a39c563299b88cdef41f33a48c3f952cc33b8f819baec4a16c118b6bfd9b

SHA512
d8c4f14bdd7d4635b5ad23d2e3776df16a0ce639f07b58785af276abfac603ebbf0ace640aa10a798ce7b3f13363a9a23a06c930b646fe9d882e029f6e6854a0

Download Submit
C:\Windows\dmxhbvxt\bkezjzwjmi.exe

Filesize
1.1MB

MD5
f88492af772a9fba20b2052714dfd164

SHA1
c1cb4cee3ed1851c417f109e28738d63aa8e8777

SHA256
7fd3d2039c43b0f72dc7500dfb9925bb1fa8d41338d28a39c0b667a39b62545e

SHA512
d273b1960e23be6832ed36746a87b0b37c292a4875f6f14d55a8a3b7e33f42cefc62b93d1ab6f9802e45cfd92d32667a74a6976a3ec27c8571cd42d7df6b9a0c

Download Submit
C:\Windows\dmxhbvxt\conf.ini

Filesize
5KB

MD5
03b4dd6e3d7e81219042c2e0646d2a1c

SHA1
fa014cc04374d86805967d9efeea73ae3f8bc91e

SHA256
e0790fb30eeec59cfabb9fdcb61995c956084c367b77beaba2e93bd0a46fcfed

SHA512
29239e7e91b3a94f4cc4d6f8649260b1fd1b7c47e72997076b43ec7e9ab037f332462b46825f8b0a621715ed0864763d8017b2c476a3deef1b41c4910ad9fd17

Download Submit
\Windows\dmxhbvxt\bkezjzwjmi.exe

Filesize
528KB

MD5
f2facc69291fc0255f70ed47d1e5594f

SHA1
a5f8e9e2dce36190a1cb1375714b02c284cca67e

SHA256
d3af65983d2aa48478815fc06d985b96ada752a20ad422fd75948f5c202d930d

SHA512
2390f985124266615be86e0ba58ace4fdb6cc215c67f5d84f18e8abfdb53a4e5cc13ffee6543752e6e907d8e3f4205e3ca6465b8057ff25d6c896674ade4d5df

Download Submit
\Windows\dmxhbvxt\bkezjzwjmi.exe

Filesize
642KB

MD5
88f93220c114ac82e9807ff9c66a8537

SHA1
226c2f9dead9254ad0b535c909251ae9c8100a59

SHA256
b905e5f7905670be8a570cc3e95ff2f35c178dfe8a7632a7f3b0529e14b62c29

SHA512
97748cd71faa4d389a412e6c5dfd89aa54654e9a39764978288060eafcbb17c798736236e46a3eb4ca317ed1563bf2a1df56ff86d2f574a2c74f48b08a94de08

Download Submit
\Windows\dmxhbvxt\bkezjzwjmi.exe

Filesize
572KB

MD5
bf64ec6548055f2044a48bcf563ddd3b

SHA1
92a497debc878b3d318b1c66918394d71c8b443d

SHA256
3016accb98190db0633635ce7bb63051eb64eb80cf0e8e6f3e9e2e455c0f76f4

SHA512
93244fcc585a61c529cbb9b2eb62fa8d0c0284d05cb39807a5c18aa52b64ba8b856b35318808ba20164f4548651a75550027080209573801dce008b1d3b5bf0a

Download Submit
\Windows\dmxhbvxt\bkezjzwjmi.exe

Filesize
355KB

MD5
507ff854c20e5bbd74522658301d9963

SHA1
fc4ce727781071fa40f850222ae5626b0fc6d254

SHA256
a2cca1ec9ad05548f1479c4c02a6457c819e35642c3a6fe8e2a4b770bd2355ff

SHA512
8a5d9619b5710ee2d51203f766484c8e8d95ce865fee89bb5375773f36aa661f7a401c9d3cdbcc98d497db9f3109138b621ea98301acf535bd839d7eb97c1f6f

Download Submit
\Windows\dmxhbvxt\bkezjzwjmi.exe

Filesize
507KB

MD5
442d89409b1075d995245451b0267c9e

SHA1
ab39a0d96737d23a64474b13558a7624db56c557

SHA256
7620647bc82d51c4674fd922e8d2ee15b2c830295b6b2db6c2e33c7a73e7e716

SHA512
b17fccf0817c8d5f00b949dc45abc43c1bc1ce15b4e1b5732b9ded090526f8c82600007b5b6b5248dae39f38e369a859e12137c3fc0e689bf348631b3552d19e

Download Submit
\Windows\dmxhbvxt\bkezjzwjmi.exe

Filesize
272KB

MD5
e692a2f3f7e1a01e22e8aa6076132437

SHA1
39ada15e42b04aa996611002415452b0919bcd47

SHA256
c302911dcb2e700acae20f7734e10dd6e7fed99699820c2c2c5332d77652a3a6

SHA512
2fe2c5f9011189dd16002c1daccefcaafdd47cc00014caa3243e0501aa838fa3e1b5bfdd68e74dec706979c211fc0224de7d0c727f7c19c2c8aaf537852775fe

Download Submit
\Windows\dmxhbvxt\bkezjzwjmi.exe

Filesize
477KB

MD5
ca5a6952b6c116b75328615b11997a42

SHA1
8284411ceda0e55eb4125ec43d8a807781861988

SHA256
fb3ddc31c7c6b9b36fd8e588ce82c98d2de274df735dc9590363ccb1655b382d

SHA512
ade74cf4eb598b39da52733fb45506045ee6e17d189c108a3efd4cba278ad4d7be3b7104d65507c1af8c8a7b226161e5845e1f4da1d1b2a828288edb9df19572

Download Submit
memory/2220-35-0x000000013F630000-0x0000000140325000-memory.dmp

Filesize
13.0MB

Download
memory/2220-36-0x0000000077A70000-0x0000000077C19000-memory.dmp

Filesize
1.7MB

Download
memory/2220-18-0x0000000077A70000-0x0000000077C19000-memory.dmp

Filesize
1.7MB

Download
memory/2220-19-0x000000013F630000-0x0000000140325000-memory.dmp

Filesize
13.0MB

Download
memory/2220-20-0x000000013F630000-0x0000000140325000-memory.dmp

Filesize
13.0MB

Download
memory/2220-22-0x000000013F630000-0x0000000140325000-memory.dmp

Filesize
13.0MB

Download
memory/2220-26-0x0000000077A70000-0x0000000077C19000-memory.dmp

Filesize
1.7MB

Download
memory/2220-3-0x000000013F630000-0x0000000140325000-memory.dmp

Filesize
13.0MB

Download
memory/2616-57-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/2616-59-0x0000000001140000-0x0000000001141000-memory.dmp

Filesize
4KB

Download
memory/2616-175-0x0000000000AC0000-0x0000000000AC2000-memory.dmp

Filesize
8KB

Download
memory/2616-174-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Filesize
4KB

Download
memory/2616-173-0x00000000010F0000-0x00000000010F1000-memory.dmp

Filesize
4KB

Download
memory/2616-172-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/2616-171-0x0000000001290000-0x0000000001859000-memory.dmp

Filesize
5.8MB

Download
memory/2616-45-0x0000000000A80000-0x0000000000A81000-memory.dmp

Filesize
4KB

Download
memory/2616-177-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2616-58-0x0000000000A10000-0x0000000000A11000-memory.dmp

Filesize
4KB

Download
memory/2616-27-0x0000000001290000-0x0000000001859000-memory.dmp

Filesize
5.8MB

Download
memory/2616-176-0x0000000000B00000-0x0000000000B01000-memory.dmp

Filesize
4KB

Download
memory/2616-38-0x0000000077C60000-0x0000000077C62000-memory.dmp

Filesize
8KB

Download
memory/2616-56-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Filesize
4KB

Download
memory/2616-54-0x0000000000C10000-0x0000000000C11000-memory.dmp

Filesize
4KB

Download
memory/2616-55-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2616-52-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Filesize
4KB

Download
memory/2616-51-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/2616-50-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Filesize
4KB

Download
memory/2616-49-0x0000000000C20000-0x0000000000C22000-memory.dmp

Filesize
8KB

Download
memory/2616-48-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/2616-53-0x0000000000A90000-0x0000000000A91000-memory.dmp

Filesize
4KB

Download
memory/2616-44-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Filesize
4KB

Download
memory/2616-185-0x0000000001290000-0x0000000001859000-memory.dmp

Filesize
5.8MB

Download