Overview

overview

10

Static

static

3

e8b963a43c...e2.exe

windows7-x64

10

e8b963a43c...e2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    28s
  • max time network
    19s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2024, 02:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e8b963a43ce7d1cc79e969a02404dc079db8220ae64bbdc77a7c9f03747da4e2.exe
  • Size 52KB
  • Sample240330-cmyvhsff48
  • SHA256 e8b963a43ce7d1cc79e969a02404dc079db8220ae64bbdc77a7c9f03747da4e2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
bootkitdiscoveryevasionexploitpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Possible privilege escalation attempt 16 IoCs
    exploit
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 16 IoCs
    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Modifies WinLogon 2 TTPs 2 IoCs
    persistence
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8b963a43ce7d1cc79e969a02404dc079db8220ae64bbdc77a7c9f03747da4e2.exe
    "C:\Users\Admin\AppData\Local\Temp\e8b963a43ce7d1cc79e969a02404dc079db8220ae64bbdc77a7c9f03747da4e2.exe"
    1⤵
    • Modifies WinLogon for persistence
    • UAC bypass
    • Disables RegEdit via registry modification
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Modifies WinLogon
    • Writes to the Master Boot Record (MBR)
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3524
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\WerFault.exe && icacls C:\Windows\System32\WerFault.exe /grant "%username%:F" && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\WerFault.exe
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:1308
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\WerFault.exe /grant "Admin:F"
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3664
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\SysWOW64\WerFault.exe && icacls C:\Windows\SysWOW64\WerFault.exe /grant "%username%:F" && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\SysWOW64\WerFault.exe
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:2232
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\SysWOW64\WerFault.exe /grant "Admin:F"
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2804
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\SysWOW64\ && icacls C:\Windows\SysWOW64\ /grant "%username%:F" && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\SysWOW64\
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:1960
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\SysWOW64\ /grant "Admin:F"
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3916
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\ && icacls C:\Windows\System32\ /grant "%username%:F" && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5000
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:4256
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\ /grant "Admin:F"
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4656
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\SysWOW64\DriverStore && icacls C:\Windows\SysWOW64\DriverStore /grant "%username%:F" && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\SysWOW64\DriverStore
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:3488
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\SysWOW64\DriverStore /grant "Admin:F"
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1680
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\SysWOW64\drivers && icacls C:\Windows\SysWOW64\drivers /grant "%username%:F" && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1812
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\SysWOW64\drivers
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:1368
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\SysWOW64\drivers /grant "Admin:F"
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:412
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\DriverStore && icacls C:\Windows\System32\DriverStore /grant "%username%:F" && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3220
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\DriverStore
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:4448
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\DriverStore /grant "Admin:F"
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3592
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Windows\system32\takeown.exe
        takeown /f C:\Windows\System32\drivers
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:2376
      • C:\Windows\system32\icacls.exe
        icacls C:\Windows\System32\drivers /grant "Admin:F"
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4284

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3524-0-0x0000017139D20000-0x0000017139D34000-memory.dmp
        Download

        memory/3524-1-0x00007FF802E70000-0x00007FF803931000-memory.dmp
        Download

        memory/3524-3-0x0000017154370000-0x0000017154380000-memory.dmp
        Download

        memory/3524-4-0x0000017154370000-0x0000017154380000-memory.dmp
        Download

        memory/3524-6-0x0000017154370000-0x0000017154380000-memory.dmp
        Download

        memory/3524-5-0x0000017154370000-0x0000017154380000-memory.dmp
        Download

        memory/3524-7-0x0000017154370000-0x0000017154380000-memory.dmp
        Download

        memory/3524-8-0x0000017154370000-0x0000017154380000-memory.dmp
        Download

        memory/3524-9-0x00000171561B0000-0x00000171562B0000-memory.dmp
        Download

        memory/3524-10-0x00007FF802E70000-0x00007FF803931000-memory.dmp
        Download