Analysis

  • max time kernel
    132s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    02-03-2024 20:26

General

  • Target

    AdStRkJ.exe

  • Size

    33.4MB

  • MD5

    3eb8af41b3573b4000377782e8bf7719

  • SHA1

    c41e2c89b50ccfe34c022a4395f0c79dedb2b980

  • SHA256

    967ca86ca75f576aa916872d908e584b4a5029dfed9277d3faf1f7fb67e99e0d

  • SHA512

    012cbe18463953a4e7e23e9f6f824b46033575d6804d72fa2eac7924b4a90c78951db38af043d3fc788f21bd63f20533340609b6da575c453937d08346de600a

  • SSDEEP

    786432:WTWY2yV45F8akEJ+iG3yE8gL52LSiTusS9jXoVu:

Malware Config

Signatures

  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Possible privilege escalation attempt 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AdStRkJ.exe
    "C:\Users\Admin\AppData\Local\Temp\AdStRkJ.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k color 47 && title Critical process && takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant %username%:F && takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant %username%:F && reagentc.exe /disable && Exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2928
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:2544
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32 /grant Admin:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2652
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\drivers
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:2676
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\drivers /grant Admin:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2688
      • C:\Windows\system32\ReAgentc.exe
        reagentc.exe /disable
        3⤵
        • Drops file in System32 directory
        PID:2712
    • C:\Program Files\Windows NT 32\MBR.exe
      "C:\Program Files\Windows NT 32\MBR.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      PID:2620
    • C:\Program Files\Windows NT 32\AdStRkJ_sound.exe
      "C:\Program Files\Windows NT 32\AdStRkJ_sound.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Windows NT 32\AdStRkJ_sound.exe

    Filesize

    141KB

    MD5

    330d74c84f4597a0c7f45b232c7b0ae2

    SHA1

    46d93d7d2907e60c0b5fb3fd7246410c33a591e9

    SHA256

    6b685298579ec278cf041c12ef0ddbc102567ef274bdd43711643da89ba799e1

    SHA512

    c88cd6a3e511a76e6baccf9b30ace996689432e335b264996cf6ce3b2f0947515e34151bc620dae1a05d96342be0f856832814a3b7cd5b898b0f8b08ca371814

  • C:\Program Files\Windows NT 32\MBR.exe

    Filesize

    179KB

    MD5

    a0195c08fbfe459520423bf0a7c20504

    SHA1

    9d62a03597d8c056951e8d377b4db62b51fbbfa3

    SHA256

    95a2cfb0da507b544ae915d6fd2a8d4fd8acb2456310e11d1bc066b531449ea9

    SHA512

    51c9cc7ade18fe5ffd8c58df5f573f625ee6831a8e3d87b8d529ad67a4334a7ca69e311e3a2b93e33b57879c93e20e8d7eef9f3ebc22b55c63f6a7a759bbadc5

  • C:\Program Files\Windows NT 32\lock_files.exe

    Filesize

    256KB

    MD5

    1a287576d58f0c02fc4b772c594148eb

    SHA1

    6a7caea118b97dc253a7f67ce0b7118b7fd78136

    SHA256

    ebd87671cbcf7c6409571c18e2d8350662851df64e6644c76b12a1b40a8c1dc6

    SHA512

    ca6ef3c8433b0f1d68458665ee9bbb7b323c2404100d5c86d6a6b327bdcdba8dec0aea3412772cd6e646b16aae36afd3d2a73be70f9b6500ab5f0d065a7e3eb6

  • C:\Program Files\Windows NT 32\sound.wav

    Filesize

    21.2MB

    MD5

    c22ec43f4e6c8b4189860c054a4064e5

    SHA1

    3b1885ca71df82a3906c71b51c0a373e8dc4d474

    SHA256

    35481f89e8b2eee81ceb5b514b44cb13dca103603a2501fbac6826fbca490c0f

    SHA512

    51a88f9e4ccee4528c47c909eb6141338f6371591276bcb2eb1dcda92ace4af621e2c8a9d36def7403a9ed8a591ef0e544108d4f539737b9054ddebef068d432

  • memory/324-29-0x000007FEF5AD0000-0x000007FEF64BC000-memory.dmp

    Filesize

    9.9MB

  • memory/324-28-0x0000000000D90000-0x0000000000DB8000-memory.dmp

    Filesize

    160KB

  • memory/324-39-0x000007FEF5AD0000-0x000007FEF64BC000-memory.dmp

    Filesize

    9.9MB

  • memory/1048-54-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-84-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-57-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-30-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-59-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-32-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-33-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-34-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-35-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-36-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-37-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-38-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-1-0x0000000000030000-0x0000000002190000-memory.dmp

    Filesize

    33.4MB

  • memory/1048-40-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-41-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-42-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-43-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-44-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-45-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-46-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-47-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-48-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-49-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-50-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-51-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-52-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-53-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-0-0x000007FEF5AD0000-0x000007FEF64BC000-memory.dmp

    Filesize

    9.9MB

  • memory/1048-55-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-56-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-23-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-22-0x000007FEF5AD0000-0x000007FEF64BC000-memory.dmp

    Filesize

    9.9MB

  • memory/1048-2-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-60-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-61-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-62-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-63-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-64-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-65-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-67-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-66-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-68-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-69-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-70-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-71-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-72-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-73-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-74-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-75-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-76-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-77-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-78-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-79-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-80-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-81-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-82-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-83-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-58-0x000000001D470000-0x000000001D4F0000-memory.dmp

    Filesize

    512KB

  • memory/1048-85-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-86-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/1048-87-0x0000000020870000-0x0000000020970000-memory.dmp

    Filesize

    1024KB

  • memory/2620-21-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB