Analysis

  • max time kernel
    145s
  • max time network
    113s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-03-2024 20:26

General

  • Target

    AdStRkJ.exe

  • Size

    33.4MB

  • MD5

    3eb8af41b3573b4000377782e8bf7719

  • SHA1

    c41e2c89b50ccfe34c022a4395f0c79dedb2b980

  • SHA256

    967ca86ca75f576aa916872d908e584b4a5029dfed9277d3faf1f7fb67e99e0d

  • SHA512

    012cbe18463953a4e7e23e9f6f824b46033575d6804d72fa2eac7924b4a90c78951db38af043d3fc788f21bd63f20533340609b6da575c453937d08346de600a

  • SSDEEP

    786432:WTWY2yV45F8akEJ+iG3yE8gL52LSiTusS9jXoVu:

Malware Config

Signatures

  • Disables RegEdit via registry modification 1 IoCs
  • Disables Task Manager via registry modification
  • Possible privilege escalation attempt 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AdStRkJ.exe
    "C:\Users\Admin\AppData\Local\Temp\AdStRkJ.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Checks computer location settings
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k color 47 && title Critical process && takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant %username%:F && takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant %username%:F && reagentc.exe /disable && Exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:8
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:2156
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32 /grant Admin:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3576
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\drivers
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:4772
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\drivers /grant Admin:F
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3804
      • C:\Windows\system32\ReAgentc.exe
        reagentc.exe /disable
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:4932
    • C:\Program Files\Windows NT 32\MBR.exe
      "C:\Program Files\Windows NT 32\MBR.exe"
      2⤵
      • Executes dropped EXE
      • Writes to the Master Boot Record (MBR)
      PID:560
    • C:\Program Files\Windows NT 32\AdStRkJ_sound.exe
      "C:\Program Files\Windows NT 32\AdStRkJ_sound.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4048
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x38c 0x394
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Windows NT 32\AdStRkJ_sound.exe

    Filesize

    141KB

    MD5

    330d74c84f4597a0c7f45b232c7b0ae2

    SHA1

    46d93d7d2907e60c0b5fb3fd7246410c33a591e9

    SHA256

    6b685298579ec278cf041c12ef0ddbc102567ef274bdd43711643da89ba799e1

    SHA512

    c88cd6a3e511a76e6baccf9b30ace996689432e335b264996cf6ce3b2f0947515e34151bc620dae1a05d96342be0f856832814a3b7cd5b898b0f8b08ca371814

  • C:\Program Files\Windows NT 32\MBR.exe

    Filesize

    179KB

    MD5

    a0195c08fbfe459520423bf0a7c20504

    SHA1

    9d62a03597d8c056951e8d377b4db62b51fbbfa3

    SHA256

    95a2cfb0da507b544ae915d6fd2a8d4fd8acb2456310e11d1bc066b531449ea9

    SHA512

    51c9cc7ade18fe5ffd8c58df5f573f625ee6831a8e3d87b8d529ad67a4334a7ca69e311e3a2b93e33b57879c93e20e8d7eef9f3ebc22b55c63f6a7a759bbadc5

  • C:\Program Files\Windows NT 32\lock_files.exe

    Filesize

    343KB

    MD5

    7734bece0c7493447d2df4b0a05179d0

    SHA1

    f8ab23f32dc38f9ae49e8debb23df5116f8fe6dc

    SHA256

    3814d3d7c09d6ad199f43a24ba0b9a831355c3f66bbeb62f9768d995be049593

    SHA512

    88686fa176b439e4c515d453617c47039984c8956be519b410d80d9757c58408f115d57eed0a6b3a14b2d09e4835491d72e5a84abf28e4e7162ef59380dcc385

  • C:\Program Files\Windows NT 32\sound.wav

    Filesize

    17.4MB

    MD5

    7d2e73f2f72bb20fa52bae59caf5a6bd

    SHA1

    62370d4921deb4e5144c6de43c05205df84b04ce

    SHA256

    6beb0272ada327dd92f7c3a5c2457325e51b7ac1206a816f1109384807660e38

    SHA512

    8a495d7255628eb91cc8c4b56ebf958075e2831e683a20c9be85a7f5082f1372993ad2bbee9fd61bd408fb74108fa699127ffb894105d7f31fcdc0a0c59a0f62

  • memory/560-28-0x0000000000400000-0x0000000000433000-memory.dmp

    Filesize

    204KB

  • memory/864-50-0x000001C26D560000-0x000001C26D570000-memory.dmp

    Filesize

    64KB

  • memory/864-0-0x00007FF8ADBF0000-0x00007FF8AE6B1000-memory.dmp

    Filesize

    10.8MB

  • memory/864-31-0x00007FF8ADBF0000-0x00007FF8AE6B1000-memory.dmp

    Filesize

    10.8MB

  • memory/864-32-0x000001C26D560000-0x000001C26D570000-memory.dmp

    Filesize

    64KB

  • memory/864-2-0x000001C26D560000-0x000001C26D570000-memory.dmp

    Filesize

    64KB

  • memory/864-76-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/864-74-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/864-46-0x000001C26D560000-0x000001C26D570000-memory.dmp

    Filesize

    64KB

  • memory/864-29-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/864-1-0x000001C250E30000-0x000001C252F90000-memory.dmp

    Filesize

    33.4MB

  • memory/864-49-0x000001C26D560000-0x000001C26D570000-memory.dmp

    Filesize

    64KB

  • memory/864-66-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/864-51-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/864-72-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/864-53-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/864-70-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/864-56-0x000001C26D560000-0x000001C26D570000-memory.dmp

    Filesize

    64KB

  • memory/864-68-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/864-58-0x000001C26D560000-0x000001C26D570000-memory.dmp

    Filesize

    64KB

  • memory/864-59-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/864-61-0x000001C26D560000-0x000001C26D570000-memory.dmp

    Filesize

    64KB

  • memory/864-62-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/864-64-0x000001C26E350000-0x000001C26E4F9000-memory.dmp

    Filesize

    1.7MB

  • memory/4048-47-0x0000020B7A6C0000-0x0000020B7A6D0000-memory.dmp

    Filesize

    64KB

  • memory/4048-57-0x0000020B7A6C0000-0x0000020B7A6D0000-memory.dmp

    Filesize

    64KB

  • memory/4048-55-0x00007FF8ADBF0000-0x00007FF8AE6B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4048-52-0x0000020B7C950000-0x0000020B7CAF9000-memory.dmp

    Filesize

    1.7MB

  • memory/4048-45-0x00007FF8ADBF0000-0x00007FF8AE6B1000-memory.dmp

    Filesize

    10.8MB

  • memory/4048-44-0x0000020B7A2E0000-0x0000020B7A308000-memory.dmp

    Filesize

    160KB