8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403

General

Target

8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
Size

3.3MB
MD5

19e3cbfb7e26ddca6332bbcd62f5d78c
SHA1

67eb601047ccb6ba96de875a2326fe55da2f1dc2
SHA256

8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403
SHA512

e18d1f824a2e7ad783e79a2db1e398a4a48d37f60d1f82d73f6b65ed70c98c0cdd6e605423453d6d05512aa0e2afbf77680758409d18d3cb0382f646d62b8769
SSDEEP

98304:3QOH5raT1GoHKqUifIwY/L4a3X62BcFOg/9MRhM6+baj:nHcBHKqUaS/LO2BM9MDMF

Score

9^/10

bootkit evasion persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

description ioc process

File opened for modification \??\PhysicalDrive0 8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

2932 regedit.exe
Runs net.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

pid	process
2932	regedit.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

pid	process
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

Suspicious use of SendNotifyMessage 9 IoCs

Processes:

8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

pid	process
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

pid	process
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.execmd.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 4388 wrote to memory of 432	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	cmd.exe
PID 4388 wrote to memory of 432	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	cmd.exe
PID 4388 wrote to memory of 432	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	cmd.exe
PID 432 wrote to memory of 3084	432	cmd.exe	net.exe
PID 432 wrote to memory of 3084	432	cmd.exe	net.exe
PID 432 wrote to memory of 3084	432	cmd.exe	net.exe
PID 3084 wrote to memory of 1372	3084	net.exe	net1.exe
PID 3084 wrote to memory of 1372	3084	net.exe	net1.exe
PID 3084 wrote to memory of 1372	3084	net.exe	net1.exe
PID 432 wrote to memory of 4572	432	cmd.exe	net.exe
PID 432 wrote to memory of 4572	432	cmd.exe	net.exe
PID 432 wrote to memory of 4572	432	cmd.exe	net.exe
PID 4572 wrote to memory of 2408	4572	net.exe	net1.exe
PID 4572 wrote to memory of 2408	4572	net.exe	net1.exe
PID 4572 wrote to memory of 2408	4572	net.exe	net1.exe
PID 432 wrote to memory of 376	432	cmd.exe	SecEdit.exe
PID 432 wrote to memory of 376	432	cmd.exe	SecEdit.exe
PID 432 wrote to memory of 376	432	cmd.exe	SecEdit.exe
PID 432 wrote to memory of 3376	432	cmd.exe	net.exe
PID 432 wrote to memory of 3376	432	cmd.exe	net.exe
PID 432 wrote to memory of 3376	432	cmd.exe	net.exe
PID 3376 wrote to memory of 4908	3376	net.exe	net1.exe
PID 3376 wrote to memory of 4908	3376	net.exe	net1.exe
PID 3376 wrote to memory of 4908	3376	net.exe	net1.exe
PID 432 wrote to memory of 3112	432	cmd.exe	net.exe
PID 432 wrote to memory of 3112	432	cmd.exe	net.exe
PID 432 wrote to memory of 3112	432	cmd.exe	net.exe
PID 3112 wrote to memory of 936	3112	net.exe	net1.exe
PID 3112 wrote to memory of 936	3112	net.exe	net1.exe
PID 3112 wrote to memory of 936	3112	net.exe	net1.exe
PID 432 wrote to memory of 2932	432	cmd.exe	regedit.exe
PID 432 wrote to memory of 2932	432	cmd.exe	regedit.exe
PID 432 wrote to memory of 2932	432	cmd.exe	regedit.exe
PID 4388 wrote to memory of 3940	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 3940	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 3940	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 3940 wrote to memory of 1656	3940	net.exe	net1.exe
PID 3940 wrote to memory of 1656	3940	net.exe	net1.exe
PID 3940 wrote to memory of 1656	3940	net.exe	net1.exe
PID 4388 wrote to memory of 3792	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 3792	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 3792	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 3792 wrote to memory of 1592	3792	net.exe	net1.exe
PID 3792 wrote to memory of 1592	3792	net.exe	net1.exe
PID 3792 wrote to memory of 1592	3792	net.exe	net1.exe
PID 4388 wrote to memory of 2008	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 2008	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 2008	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 2008 wrote to memory of 4728	2008	net.exe	net1.exe
PID 2008 wrote to memory of 4728	2008	net.exe	net1.exe
PID 2008 wrote to memory of 4728	2008	net.exe	net1.exe
PID 4388 wrote to memory of 712	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 712	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 712	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 712 wrote to memory of 1604	712	net.exe	net1.exe
PID 712 wrote to memory of 1604	712	net.exe	net1.exe
PID 712 wrote to memory of 1604	712	net.exe	net1.exe
PID 4388 wrote to memory of 4520	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 4520	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 4520	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 4532	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 4532	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 4532	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe
PID 4388 wrote to memory of 5104	4388	8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe
"C:\Users\Admin\AppData\Local\Temp\8169672f78da3db3ed6f2da6581d6730bf55197cb703fa96fb98408b02dc5403.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4388

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\¿ªÆô¹²Ïí.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:432

C:\Windows\SysWOW64\net.exe
NET USER Guest /active:yes
3⤵
- Suspicious use of WriteProcessMemory
PID:3084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 USER Guest /active:yes
4⤵
PID:1372

C:\Windows\SysWOW64\net.exe
NET USER Guest /passwordreq:no
3⤵
- Suspicious use of WriteProcessMemory
PID:4572

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 USER Guest /passwordreq:no
4⤵
PID:2408

C:\Windows\SysWOW64\SecEdit.exe
Secedit /configure /cfg "security.inf" /db secsetup.sdb /areas USER_RIGHTS /verbose
3⤵
PID:376

C:\Windows\SysWOW64\net.exe
net user guest /active:yes
3⤵
- Suspicious use of WriteProcessMemory
PID:3376

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user guest /active:yes
4⤵
PID:4908

C:\Windows\SysWOW64\net.exe
net user guest ""
3⤵
- Suspicious use of WriteProcessMemory
PID:3112

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user guest ""
4⤵
PID:936

C:\Windows\SysWOW64\regedit.exe
regedit /s ┐¬╞⌠╣▓╧φ.reg
3⤵
- Runs .reg file with regedit
PID:2932

C:\Windows\SysWOW64\net.exe
net start workstation
2⤵
- Suspicious use of WriteProcessMemory
PID:3940

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start workstation
3⤵
PID:1656

C:\Windows\SysWOW64\net.exe
net start "Computer Browser"
2⤵
- Suspicious use of WriteProcessMemory
PID:3792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start "Computer Browser"
3⤵
PID:1592

C:\Windows\SysWOW64\net.exe
net start server
2⤵
- Suspicious use of WriteProcessMemory
PID:2008

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start server
3⤵
PID:4728

C:\Windows\SysWOW64\net.exe
net start netbios
2⤵
- Suspicious use of WriteProcessMemory
PID:712

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start netbios
3⤵
PID:1604

C:\Windows\SysWOW64\net.exe
net share ±¾µØ£¨CÅÌ)=C:\
2⤵
PID:4520

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share ±¾µØ£¨CÅÌ)=C:\
3⤵
PID:4156

C:\Windows\SysWOW64\net.exe
net share ±¾µØ£¨DÅÌ)=D:\
2⤵
PID:4532

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share ±¾µØ£¨DÅÌ)=D:\
3⤵
PID:1312

C:\Windows\SysWOW64\net.exe
net share ±¾µØ£¨FÅÌ)=F:\
2⤵
PID:5104

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share ±¾µØ£¨FÅÌ)=F:\
3⤵
PID:2484

C:\Windows\SysWOW64\net.exe
net share ÎïÀíÖ÷»ú×ÀÃæ=C:\Users\Admin\Desktop
2⤵
PID:4672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share ÎïÀíÖ÷»ú×ÀÃæ=C:\Users\Admin\Desktop
3⤵
PID:4228

C:\Windows\SysWOW64\cacls.exe
cacls C:\Users\Admin\Desktop /e /t /g everyone:F
2⤵
PID:2764

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\¿ªÆô¹²Ïí.bat
Filesize
242B

MD5
80f0e65f938e3259b19f89241858ae23

SHA1
f6d463a58007cc20b70988563c49b3410e68e92b

SHA256
49b26f11aa955b7db4acc775b09476638525772c1a09e7c31dfdca19f6973dba

SHA512
d51279e860cf401cba03c90d4edea4cfe408725b6a8737cfc3c63110f7f13f63f52ed350c2e79d1a287172d8c77d6a7dc658a1ac1d4867504a886aa108501d95

Download Submit
\??\PIPE\lsarpc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4388-0-0x0000000000400000-0x0000000000C6A000-memory.dmp

Filesize
8.4MB

Download
memory/4388-3-0x0000000000400000-0x0000000000C6A000-memory.dmp

Filesize
8.4MB

Download
memory/4388-4-0x0000000000400000-0x0000000000C6A000-memory.dmp

Filesize
8.4MB

Download
memory/4388-2-0x0000000000400000-0x0000000000C6A000-memory.dmp

Filesize
8.4MB

Download
memory/4388-13-0x0000000000400000-0x0000000000C6A000-memory.dmp

Filesize
8.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads