Analysis

  • max time kernel
    117s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    07/05/2024, 11:17

General

  • Target

    2df908df3695285c6d835ac914fcbcaaa9f7b53dc2ef60971ef3301b0b2c2e1a.exe

  • Size

    2.4MB

  • MD5

    16158adcf180c16c53f4926e98878ae6

  • SHA1

    2c5e1464567982b647c7ed608d78709577219d48

  • SHA256

    2df908df3695285c6d835ac914fcbcaaa9f7b53dc2ef60971ef3301b0b2c2e1a

  • SHA512

    edb8902e8bf7f3ac98787faff8e0fc7c82c41ad9865b5522e12672b2f0a6febf3a92a7dfcce49f0766aadb16a05d93f72723f43509a15f7815c8edefd3c6b1db

  • SSDEEP

    49152:8VDZKvw4H8LMonNhJ+DkJE6GFVfoPRNJzkBt8:SDEvw4qjj2ENJ

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 6 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 16 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2df908df3695285c6d835ac914fcbcaaa9f7b53dc2ef60971ef3301b0b2c2e1a.exe
    "C:\Users\Admin\AppData\Local\Temp\2df908df3695285c6d835ac914fcbcaaa9f7b53dc2ef60971ef3301b0b2c2e1a.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3000
    • C:\Users\Admin\AppData\Local\Temp\KB931125.exe
      "C:\Users\Admin\AppData\Local\Temp\KB931125.exe" /Q
      2⤵
      • Modifies Installed Components in the registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe authroots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        PID:2212
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe updroots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        PID:772
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -l roots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:240
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe -d delroots.sst
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:584

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\authroots.sst

          Filesize

          73KB

          MD5

          bb49ccc10926cdb601eba81afef749a2

          SHA1

          a4766c9aea8d211e9632148fd4b625cece195be9

          SHA256

          f013ee3b7fede9a95844e83e83ee298d38cba6efce5a5cafcd8b95255c32f86c

          SHA512

          94c2809727039d1ed07a3742a4b2f9300e865ea7c49bc1fcf547a30238eeecc88d8dd06a2d4f3112317f948908b9af082b50f412a41a2bcb48d5e30d6d8ecbba

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\delroots.sst

          Filesize

          9KB

          MD5

          7b32871e409608ff887b6cf4d87debb0

          SHA1

          191f9ea1298ee52dbd6f977b3584109a064f57b9

          SHA256

          3f01268547364d2d60a0f65b46757cccfd9225fc39d581846a8fbffdb5756ff2

          SHA512

          534a384f7946db4083e639b8e02d83ac97293c60630b8811a84c85e0330e9c293f05f5cf71e0f3580551e7923bc5a3bfb7f0406432ca3cdb7efeb4a950ac5e8a

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\roots.sst

          Filesize

          7KB

          MD5

          9e5de0fd1f90486a66dee4bfe89a78d7

          SHA1

          90e3188ef63495aaa71c85d4ff0f23253c834b40

          SHA256

          8b95ff56d61586582864d05563762615c8705779578dca3c98a303c3b1f4122e

          SHA512

          60006fa6f57e4d280642d51055f85f8d27b913ce71373de5b928c515c77647295030ab73ab4a55024de4a40c18f200909f49ffb52c26cf554835fc3d4cc348f1

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rootsupd.inf

          Filesize

          1KB

          MD5

          421e60325404f5f29ac04c9b9d59096b

          SHA1

          aace2fd74d799e8af5c8d5b2646361bb67a1620c

          SHA256

          571a8da5298aacc37700c747ee5d72b5a7797835140e7a4d4f895e9604574d77

          SHA512

          86693975b1b187ee65b0a23b1f3f8e05d1a3f61e7e47b060f938fe1602bbad96021847b709e64c2d5a295b72f10f4db587a11a1e7ca0a0b64c3bed7fa683b1d2

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.sst

          Filesize

          320KB

          MD5

          2d9b4498c847715418160bfd7e7c8a2d

          SHA1

          e0873091d476d2566aa6fc988cb364247c95dc97

          SHA256

          c49c05b701c390c679e5e3226ec621f22a08155b1065fcfc37b509f648f03b41

          SHA512

          dcf3208cdd1e4353f82823f796d735c1209f149f183eea827a90753ec55509a1c460a16c120e07c12a5eacf0e67d2661c25638491ecf4403e25d6508983e519b

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL

          Filesize

          89KB

          MD5

          a64e4b204d44548eeb5c3d86eca2ad70

          SHA1

          e3245bf6dbb2e56d71a9cbad2697aa4fa0df6bbe

          SHA256

          985a5603ebf94539ac11549999f83b5e6dc008180994898c5daa6fd31ae1e9dc

          SHA512

          dca4099318954bab5f1204645be0d0e8fea0c2e97ee95496fa884fbed627e376358623fa94c39bf0abe97d07d46a7e6c5e1081496cdd1987e07e595995a46cd5

        • \Users\Admin\AppData\Local\Temp\IXP000.TMP\updroots.exe

          Filesize

          5KB

          MD5

          9c18ae971cbffb096952177f6804ea31

          SHA1

          bb255dd1bd9bb39cdbb8671af66054432c686828

          SHA256

          2703c25453b09c40ee81fdc458b8cc24712e387a12d15ff94e12b02921fe98cb

          SHA512

          21086509bb4ea5afede55d034955de0bdf8b366d5d8d4bfa7a6c68b0f35fbf217ff3e932f87fc1d37f09022805e79ceeecbaf3dbccbd96d7c93029ffe7370e4c

        • \Users\Admin\AppData\Local\Temp\KB931125.exe

          Filesize

          349KB

          MD5

          4a4d72d34f9da1fc5019e0748fcde2f5

          SHA1

          f54752ec63369522f37e545325519ee434cdf439

          SHA256

          83b660f3f3eaddd4b388ed3f806f7444f03429fb63fc1f8db3d86294914a05ca

          SHA512

          95986ffbf51483a0d1a256028847c7ee6ac73ffd62f6d838309a69e1833f719a7cfed5422815f4d4a49dbd599c449f8db8f60273136720cb1da5f8b0eb24cb33

        • \Users\Admin\AppData\Local\Temp\NetBridge.dll

          Filesize

          238KB

          MD5

          8786d469338c30e0ba9fedfc62bd5197

          SHA1

          5fb12028ceae9772f938e1b98b699f0e02e32718

          SHA256

          beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f

          SHA512

          5db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c

        • memory/3000-1-0x0000000077B60000-0x0000000077B70000-memory.dmp

          Filesize

          64KB

        • memory/3000-0-0x0000000077B60000-0x0000000077B70000-memory.dmp

          Filesize

          64KB