Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 05:23
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe
-
Size
19.8MB
-
MD5
1a5bd43c86e59b1849bdf8da1eb9f9b8
-
SHA1
2d9240c02b9ef845338761cd0398bae5a9aa89d0
-
SHA256
75f17b7472b10d465ca8a978d2cea8522e5675b376ba8743b36437990bc078bb
-
SHA512
f5b1da9d8119d3c0a2fdaf1c7d0bd6b4165531eae3426126b587d5d530969511f29ef4d4ef7d91949b905d10544a61ffb06cc9759e0f76adc12b4f4902d7434f
-
SSDEEP
393216:e0O5hIi4IUZzF8FcRIZHpKZgzLxNweoxyWTQZRoThwcHrmu3N:UyZz9RSHEZgHPybH
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 5 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\SdsData\res2\bootice.exe UPX behavioral1/memory/344-120-0x0000000000C70000-0x0000000000DB3000-memory.dmp UPX behavioral1/memory/344-124-0x0000000000C70000-0x0000000000DB3000-memory.dmp UPX behavioral1/memory/628-147-0x0000000000250000-0x0000000000393000-memory.dmp UPX behavioral1/memory/628-150-0x0000000000250000-0x0000000000393000-memory.dmp UPX -
Executes dropped EXE 5 IoCs
Processes:
7z.exeMiniThunderPlatform.exebootice.exeUSORT.EXEbootice.exepid process 1184 7z.exe 2956 MiniThunderPlatform.exe 344 bootice.exe 764 USORT.EXE 628 bootice.exe -
Loads dropped DLL 20 IoCs
Processes:
cmd.exe7z.exe2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exeMiniThunderPlatform.execmd.execmd.execmd.exepid process 2464 cmd.exe 2464 cmd.exe 1184 7z.exe 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe 2956 MiniThunderPlatform.exe 2956 MiniThunderPlatform.exe 2956 MiniThunderPlatform.exe 2956 MiniThunderPlatform.exe 2956 MiniThunderPlatform.exe 2956 MiniThunderPlatform.exe 2956 MiniThunderPlatform.exe 1948 cmd.exe 2184 cmd.exe 2184 cmd.exe 2956 MiniThunderPlatform.exe 2072 cmd.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\SdsData\res2\bootice.exe upx behavioral1/memory/344-120-0x0000000000C70000-0x0000000000DB3000-memory.dmp upx behavioral1/memory/344-124-0x0000000000C70000-0x0000000000DB3000-memory.dmp upx behavioral1/memory/628-147-0x0000000000250000-0x0000000000393000-memory.dmp upx behavioral1/memory/628-150-0x0000000000250000-0x0000000000393000-memory.dmp upx -
Enumerates connected drives 3 TTPs 27 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exebootice.exebootice.exedescription ioc process File opened (read-only) \??\S: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\U: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\V: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\L: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\P: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\Z: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\N: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\J: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\G: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\R: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\T: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\W: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\F: bootice.exe File opened (read-only) \??\Y: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\E: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\H: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\M: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\X: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\A: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\I: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\F: bootice.exe File opened (read-only) \??\D: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\Q: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\B: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\K: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\O: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe File opened (read-only) \??\F: 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
MiniThunderPlatform.exeUSORT.EXEdescription ioc process File opened for modification \??\PhysicalDrive0 MiniThunderPlatform.exe File opened for modification \??\PhysicalDrive0 USORT.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exePowerShell.exepid process 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe 2928 PowerShell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
bootice.exewmic.exewmic.exedescription pid process Token: SeDebugPrivilege 344 bootice.exe Token: SeAuditPrivilege 344 bootice.exe Token: SeSecurityPrivilege 344 bootice.exe Token: SeBackupPrivilege 344 bootice.exe Token: SeRestorePrivilege 344 bootice.exe Token: SeTakeOwnershipPrivilege 344 bootice.exe Token: SeManageVolumePrivilege 344 bootice.exe Token: SeSystemEnvironmentPrivilege 344 bootice.exe Token: SeShutdownPrivilege 344 bootice.exe Token: SeIncreaseQuotaPrivilege 1812 wmic.exe Token: SeSecurityPrivilege 1812 wmic.exe Token: SeTakeOwnershipPrivilege 1812 wmic.exe Token: SeLoadDriverPrivilege 1812 wmic.exe Token: SeSystemProfilePrivilege 1812 wmic.exe Token: SeSystemtimePrivilege 1812 wmic.exe Token: SeProfSingleProcessPrivilege 1812 wmic.exe Token: SeIncBasePriorityPrivilege 1812 wmic.exe Token: SeCreatePagefilePrivilege 1812 wmic.exe Token: SeBackupPrivilege 1812 wmic.exe Token: SeRestorePrivilege 1812 wmic.exe Token: SeShutdownPrivilege 1812 wmic.exe Token: SeDebugPrivilege 1812 wmic.exe Token: SeSystemEnvironmentPrivilege 1812 wmic.exe Token: SeRemoteShutdownPrivilege 1812 wmic.exe Token: SeUndockPrivilege 1812 wmic.exe Token: SeManageVolumePrivilege 1812 wmic.exe Token: 33 1812 wmic.exe Token: 34 1812 wmic.exe Token: 35 1812 wmic.exe Token: SeIncreaseQuotaPrivilege 1752 wmic.exe Token: SeSecurityPrivilege 1752 wmic.exe Token: SeTakeOwnershipPrivilege 1752 wmic.exe Token: SeLoadDriverPrivilege 1752 wmic.exe Token: SeSystemProfilePrivilege 1752 wmic.exe Token: SeSystemtimePrivilege 1752 wmic.exe Token: SeProfSingleProcessPrivilege 1752 wmic.exe Token: SeIncBasePriorityPrivilege 1752 wmic.exe Token: SeCreatePagefilePrivilege 1752 wmic.exe Token: SeBackupPrivilege 1752 wmic.exe Token: SeRestorePrivilege 1752 wmic.exe Token: SeShutdownPrivilege 1752 wmic.exe Token: SeDebugPrivilege 1752 wmic.exe Token: SeSystemEnvironmentPrivilege 1752 wmic.exe Token: SeRemoteShutdownPrivilege 1752 wmic.exe Token: SeUndockPrivilege 1752 wmic.exe Token: SeManageVolumePrivilege 1752 wmic.exe Token: 33 1752 wmic.exe Token: 34 1752 wmic.exe Token: 35 1752 wmic.exe Token: SeIncreaseQuotaPrivilege 1812 wmic.exe Token: SeSecurityPrivilege 1812 wmic.exe Token: SeTakeOwnershipPrivilege 1812 wmic.exe Token: SeLoadDriverPrivilege 1812 wmic.exe Token: SeSystemProfilePrivilege 1812 wmic.exe Token: SeSystemtimePrivilege 1812 wmic.exe Token: SeProfSingleProcessPrivilege 1812 wmic.exe Token: SeIncBasePriorityPrivilege 1812 wmic.exe Token: SeCreatePagefilePrivilege 1812 wmic.exe Token: SeBackupPrivilege 1812 wmic.exe Token: SeRestorePrivilege 1812 wmic.exe Token: SeShutdownPrivilege 1812 wmic.exe Token: SeDebugPrivilege 1812 wmic.exe Token: SeSystemEnvironmentPrivilege 1812 wmic.exe Token: SeRemoteShutdownPrivilege 1812 wmic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2176 wrote to memory of 2464 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 2464 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 2464 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 2464 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2464 wrote to memory of 1184 2464 cmd.exe 7z.exe PID 2464 wrote to memory of 1184 2464 cmd.exe 7z.exe PID 2464 wrote to memory of 1184 2464 cmd.exe 7z.exe PID 2464 wrote to memory of 1184 2464 cmd.exe 7z.exe PID 2176 wrote to memory of 2956 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe MiniThunderPlatform.exe PID 2176 wrote to memory of 2956 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe MiniThunderPlatform.exe PID 2176 wrote to memory of 2956 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe MiniThunderPlatform.exe PID 2176 wrote to memory of 2956 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe MiniThunderPlatform.exe PID 2176 wrote to memory of 1948 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 1948 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 1948 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 1948 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 1948 wrote to memory of 344 1948 cmd.exe bootice.exe PID 1948 wrote to memory of 344 1948 cmd.exe bootice.exe PID 1948 wrote to memory of 344 1948 cmd.exe bootice.exe PID 1948 wrote to memory of 344 1948 cmd.exe bootice.exe PID 2176 wrote to memory of 1812 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe wmic.exe PID 2176 wrote to memory of 1812 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe wmic.exe PID 2176 wrote to memory of 1812 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe wmic.exe PID 2176 wrote to memory of 1812 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe wmic.exe PID 2176 wrote to memory of 1752 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe wmic.exe PID 2176 wrote to memory of 1752 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe wmic.exe PID 2176 wrote to memory of 1752 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe wmic.exe PID 2176 wrote to memory of 1752 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe wmic.exe PID 2176 wrote to memory of 2284 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 2284 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 2284 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 2284 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 2184 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 2184 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 2184 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 2184 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2284 wrote to memory of 664 2284 cmd.exe WMIC.exe PID 2284 wrote to memory of 664 2284 cmd.exe WMIC.exe PID 2284 wrote to memory of 664 2284 cmd.exe WMIC.exe PID 2284 wrote to memory of 664 2284 cmd.exe WMIC.exe PID 2184 wrote to memory of 764 2184 cmd.exe USORT.EXE PID 2184 wrote to memory of 764 2184 cmd.exe USORT.EXE PID 2184 wrote to memory of 764 2184 cmd.exe USORT.EXE PID 2184 wrote to memory of 764 2184 cmd.exe USORT.EXE PID 2176 wrote to memory of 1104 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 1104 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 1104 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 1104 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 1104 wrote to memory of 1856 1104 cmd.exe WMIC.exe PID 1104 wrote to memory of 1856 1104 cmd.exe WMIC.exe PID 1104 wrote to memory of 1856 1104 cmd.exe WMIC.exe PID 1104 wrote to memory of 1856 1104 cmd.exe WMIC.exe PID 2176 wrote to memory of 1564 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 1564 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 1564 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 1564 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 1564 wrote to memory of 940 1564 cmd.exe WMIC.exe PID 1564 wrote to memory of 940 1564 cmd.exe WMIC.exe PID 1564 wrote to memory of 940 1564 cmd.exe WMIC.exe PID 1564 wrote to memory of 940 1564 cmd.exe WMIC.exe PID 2176 wrote to memory of 976 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 976 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 976 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe PID 2176 wrote to memory of 976 2176 2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_1a5bd43c86e59b1849bdf8da1eb9f9b8_magniber_revil.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SdsData\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\SdsData\Resouce.7z" -aoa"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\SdsData\7z.exe"C:\Users\Admin\AppData\Local\Temp\SdsData\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\SdsData\Resouce.7z" -aoa3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\SdsData\download\MiniThunderPlatform.exe"C:\Users\Admin\AppData\Local\Temp\SdsData\download\MiniThunderPlatform.exe" -StartTP2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:2956 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SdsData\res2\BOOTICE.exe" /diskinfo /list: /file=test.ini"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\SdsData\res2\bootice.exe"C:\Users\Admin\AppData\Local\Temp\SdsData\res2\BOOTICE.exe" /diskinfo /list: /file=test.ini3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:344 -
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic.exe" baseboard list full2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1812 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic diskdrive get serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1752 -
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic BaseBoard get Manufacturer2⤵
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic BaseBoard get Manufacturer3⤵PID:664
-
C:\Windows\SysWOW64\cmd.execmd.exe /c C:\Users\Admin\AppData\Local\Temp\SdsData\res2\USORT.EXE -mohong2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\SdsData\res2\USORT.EXEC:\Users\Admin\AppData\Local\Temp\SdsData\res2\USORT.EXE -mohong3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:764 -
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic BaseBoard get Product2⤵
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic BaseBoard get Product3⤵PID:1856
-
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic BaseBoard get Manufacturer2⤵
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic BaseBoard get Manufacturer3⤵PID:940
-
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic BaseBoard get Product2⤵PID:976
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic BaseBoard get Product3⤵PID:2964
-
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic memorychip get speed2⤵PID:892
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic memorychip get speed3⤵PID:3068
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\SdsData\res2\BOOTICE.exe" /diskinfo /list: /file=test.ini"2⤵
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\SdsData\res2\bootice.exe"C:\Users\Admin\AppData\Local\Temp\SdsData\res2\BOOTICE.exe" /diskinfo /list: /file=test.ini3⤵
- Executes dropped EXE
- Enumerates connected drives
PID:628 -
C:\Windows\SysWOW64\Wbem\wmic.exewmic diskdrive get serialnumber2⤵PID:1508
-
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic BaseBoard get Manufacturer2⤵PID:2912
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic BaseBoard get Manufacturer3⤵PID:1576
-
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic BaseBoard get Product2⤵PID:2592
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic BaseBoard get Product3⤵PID:1648
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\PowerShell.exePowerShell.exe /c "Get-BitLockerVolume"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2928
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\SdsData\7z.dllFilesize
893KB
MD504ad4b80880b32c94be8d0886482c774
SHA1344faf61c3eb76f4a2fb6452e83ed16c9cce73e0
SHA256a1e1d1f0fff4fcccfbdfa313f3bdfea4d3dfe2c2d9174a615bbc39a0a6929338
SHA5123e3aaf01b769471b18126e443a721c9e9a0269e9f5e48d0a10251bc1ee309855bd71ede266caa6828b007359b21ba562c2a5a3469078760f564fb7bd43acabfb
-
C:\Users\Admin\AppData\Local\Temp\SdsData\7z.exeFilesize
160KB
MD5a51d90f2f9394f5ea0a3acae3bd2b219
SHA120fea1314dbed552d5fedee096e2050369172ee1
SHA256ac9674feb8f2fad20c1e046de67f899419276ae79a60e8cc021a4bf472ae044f
SHA512c11f981136db7d9bde01046b1953fd924ff29447d41257da09dd762451e27390cea9b69e43206a8fff825ebcd4ddec5a6247bb502aefbd6e8285622caa985bf6
-
C:\Users\Admin\AppData\Local\Temp\SdsData\Resouce.7zFilesize
5.3MB
MD5f6e006c22adc4e3476e4bdb2dc55828e
SHA1aaa7f6ad7e7c8279a8fae3436f92a92b686ac9b7
SHA256de4d1d7d51fb59fca94e24e7f60acce1294b418abebfa5d8c26d79f5b238ec30
SHA51209d3e7ffe52b7090d0da985b4a4f2bf7f4ff02442826cb0dc57cff45d33a934cdde8683bfcc666a729d4f12da630c9dfb85048580bac2d0a77cf2396be4d75bc
-
C:\Users\Admin\AppData\Local\Temp\SdsData\download\ATL71.DLLFilesize
87KB
MD579cb6457c81ada9eb7f2087ce799aaa7
SHA1322ddde439d9254182f5945be8d97e9d897561ae
SHA256a68e1297fae2bcf854b47ffa444f490353028de1fa2ca713b6cf6cc5aa22b88a
SHA512eca4b91109d105b2ce8c40710b8e3309c4cc944194843b7930e06daf3d1df6ae85c1b7063036c7e5cd10276e5e5535b33e49930adbad88166228316283d011b8
-
C:\Users\Admin\AppData\Local\Temp\SdsData\download\MSVCP71.dllFilesize
492KB
MD5a94dc60a90efd7a35c36d971e3ee7470
SHA1f936f612bc779e4ba067f77514b68c329180a380
SHA2566c483cbe349863c7dcf6f8cb7334e7d28c299e7d5aa063297ea2f62352f6bdd9
SHA512ff6c41d56337cac074582002d60cbc57263a31480c67ee8999bc02fc473b331eefed93ee938718d297877cf48471c7512741b4aebc0636afc78991cdf6eddfab
-
C:\Users\Admin\AppData\Local\Temp\SdsData\download\MSVCR71.dllFilesize
340KB
MD5ca2f560921b7b8be1cf555a5a18d54c3
SHA1432dbcf54b6f1142058b413a9d52668a2bde011d
SHA256c4d4339df314a27ff75a38967b7569d9962337b8d4cd4b0db3aba5ff72b2bfbb
SHA51223e0bdd9458a5a8e0f9bbcb7f6ce4f87fcc9e47c1ee15f964c17ff9fe8d0f82dd3a0f90263daaf1ee87fad4a238aa0ee92a16b3e2c67f47c84d575768edba43e
-
C:\Users\Admin\AppData\Local\Temp\SdsData\download\MiniThunderPlatform.exeFilesize
262KB
MD50c8f2b0ee5bf990c6541025e94985c9f
SHA1be942f5fef752b0070ba97998bfe763b96529aa2
SHA25612d6cc86fdc69e1aa8d94d38715bbe271994c0f86f85283fa2190da7c322f4c8
SHA5127b0e81149fafa88050a125155732057190d8f93e8d62cb05a68da9cf24e30228f14d0ffd888c0362bffd5872e970200098e75572b2819abeea10022ab1a264f6
-
C:\Users\Admin\AppData\Local\Temp\SdsData\download\XLBugHandler.dllFilesize
98KB
MD592154e720998acb6fa0f7bad63309470
SHA1385817793b9f894ca3dd3bac20b269652df6cbc6
SHA2561845df41da539bca264f59365bf7453b686b9098cc94cd0e2b9a20c74a561096
SHA51237ba81f338af7de7ef2ac6bcf67b3aec96f9b748830ee3c0b152029871f7701e917b94a6b51acd7be6f8f02aea2b25f3b14ced1a218bf4868af04f5207bb5fff
-
C:\Users\Admin\AppData\Local\Temp\SdsData\download\XLBugReport.exeFilesize
242KB
MD567c767470d0893c4a2e46be84c9afcbb
SHA100291089b13a93f82ee49a11156521f13ea605cd
SHA25664f8d68cc1cfc5b9cc182df3becf704af93d0f1cc93ee59dbf682c75b6d4ffc0
SHA512d5d3a96dec616b0ab0cd0586fa0cc5a10ba662e0d5e4de4d849ac62ca5d60ec133f54d109d1d130b5f99ae73e7abfb284ec7d5ba55dca1a4f354c6af73c00e35
-
C:\Users\Admin\AppData\Local\Temp\SdsData\download\dl_peer_id.dllFilesize
89KB
MD5dba9a19752b52943a0850a7e19ac600a
SHA13485ac30cd7340eccb0457bca37cf4a6dfda583d
SHA25669a5e2a51094dc8f30788d63243b12a0eb2759a3f3c3a159b85fd422fc00ac26
SHA512a42c1ec5594c6f6cae10524cdad1f9da2bdc407f46e685e56107de781b9bce8210a8cd1a53edacd61365d37a1c7ceba3b0891343cf2c31d258681e3bf85049d3
-
C:\Users\Admin\AppData\Local\Temp\SdsData\download\download_engine.dllFilesize
3.4MB
MD51a87ff238df9ea26e76b56f34e18402c
SHA12df48c31f3b3adb118f6472b5a2dc3081b302d7c
SHA256abaeb5121548256577ddd8b0fc30c9ff3790649ad6a0704e4e30d62e70a72964
SHA512b2e63aba8c081d3d38bd9633a1313f97b586b69ae0301d3b32b889690327a575b55097f19cc87c6e6ed345f1b4439d28f981fdb094e6a095018a10921dae80d9
-
C:\Users\Admin\AppData\Local\Temp\SdsData\download\id.datFilesize
40B
MD50be78c38021ed1585770f4709c75958b
SHA1e9e3096e7cecdeadd5e69d714f0bb8ff2191521e
SHA256d8c1f72b74bf08838080118c897b8fd50046edf036a045813bb9cc082dbf4a5d
SHA51238da85702b15cb2020129c2dd88db8ffd6ec46d7c5d8c3a35717a9f186a83de71e90827e5c943972f211b0cd2a4b6366260d3c525591150f1237d979578c4d19
-
C:\Users\Admin\AppData\Local\Temp\SdsData\download\zlib1.dllFilesize
58KB
MD589f6488524eaa3e5a66c5f34f3b92405
SHA1330f9f6da03ae96dfa77dd92aae9a294ead9c7f7
SHA256bd29d2b1f930e4b660adf71606d1b9634188b7160a704a8d140cadafb46e1e56
SHA512cfe72872c89c055d59d4de07a3a14cd84a7e0a12f166e018748b9674045b694793b6a08863e791be4f9095a34471fd6abe76828dc8c653be8c66923a5802b31e
-
C:\Users\Admin\AppData\Local\Temp\SdsData\res2\USORT.EXEFilesize
23KB
MD50cb9c0329fefacfd49c0f76c41c12b42
SHA135f3503e41adb04bb61fdc7a6a111b06522f8655
SHA256173eea9ed8cfb54b85795b6de94dce01be1132ef7cfced9825a7632cb19c7c2d
SHA512461140c9bcc6cbb46f0e827b6079775ffd68ff76a9ed5788baa20e373ce84a8dfaecc8ed60fa28392002551cbbdb4fda3c954290f8a3a281c31ad7ba91345d55
-
C:\Users\Admin\AppData\Local\Temp\SdsData\res2\test.iniFilesize
79B
MD5ff41ee833776cc2413f72c73205d9409
SHA1e06ce48da839ff631f8f8ec2437991c6f89077c5
SHA25673e28c2628bceebbf8b0c683998217bf82806c707c6427bd900096192eef3e75
SHA512287647895f197def978475e292440882281c8b8d0f999bff0ef2b2194094db72fd5ff9a8f189f033359e3a47f7cc6c2fe5f07bb8b7c24d659c5160ffa4a5d1af
-
C:\Users\Admin\AppData\Local\Temp\SdsData\xldl.dllFilesize
286KB
MD540e8d381da7c2badc4b6f0cdb4b5378f
SHA13646338c6a20f17bf4383a8d053ce37681df8ead
SHA256cb0b0c42dae0a1e946f97f6bda522eb5ad943cb632ba3d19f597ecb3e1f5eb94
SHA51268dc5128d2e90885ca0e69dced80254e87ab765faefaf152b3cf452b37fb730ec146d4930342ced3f227bd7622a93592526d73567155346de14cd76e5180e7b3
-
C:\Users\Admin\AppData\Roaming\cookieFilesize
135B
MD5fc31b34eb1f36e5ff23be7f4621aa04e
SHA1cef8d9c3577f04c9e102f942ee9bbe98dec50df5
SHA256be7a52d6d1b2e5e2c7a9e338f3ab71b4b2e76797f19cc06d5899aece2701365b
SHA512c5289e754453876b9646124952850f27325af5345c7522b9478a51c794277d5d0fa55cc105cbcab4dd72a2f76b107b97cea49a0296512c086412ddeb92441a65
-
\Users\Admin\AppData\Local\Temp\SdsData\res2\bootice.exeFilesize
416KB
MD50e72509b2d5c55093e2c9ad141067644
SHA14470a289016e2815777d3eec2bf7f985730249cd
SHA256a65ecb7bcb0fbc02ecc72300e10a36171c55ff322de5f6390669973bf49a2587
SHA5123ceebfc64649c7a325fbfdfefaeb437a742e005ab270ca614a2c3907b02cf61a55f42f0b1d9b0f66e2a4bffa22b29d6f64625ef03fd179958429303995be1b24
-
memory/344-124-0x0000000000C70000-0x0000000000DB3000-memory.dmpFilesize
1.3MB
-
memory/344-120-0x0000000000C70000-0x0000000000DB3000-memory.dmpFilesize
1.3MB
-
memory/628-147-0x0000000000250000-0x0000000000393000-memory.dmpFilesize
1.3MB
-
memory/628-150-0x0000000000250000-0x0000000000393000-memory.dmpFilesize
1.3MB
-
memory/764-130-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1948-119-0x0000000002390000-0x00000000024D3000-memory.dmpFilesize
1.3MB
-
memory/2072-146-0x0000000002470000-0x00000000025B3000-memory.dmpFilesize
1.3MB
-
memory/2176-89-0x0000000000F00000-0x0000000000F56000-memory.dmpFilesize
344KB
-
memory/2176-90-0x0000000000F00000-0x0000000000F56000-memory.dmpFilesize
344KB
-
memory/2176-86-0x0000000000F00000-0x0000000000F56000-memory.dmpFilesize
344KB
-
memory/2176-85-0x0000000000F00000-0x0000000000F56000-memory.dmpFilesize
344KB
-
memory/2176-157-0x0000000000F00000-0x0000000000F56000-memory.dmpFilesize
344KB
-
memory/2956-92-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/2956-106-0x0000000002A10000-0x0000000002D70000-memory.dmpFilesize
3.4MB
-
memory/2956-103-0x000000006FFF0000-0x0000000070000000-memory.dmpFilesize
64KB
-
memory/2956-168-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB