Analysis
-
max time kernel
26s -
max time network
27s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
26-05-2024 13:00
Static task
static1
Behavioral task
behavioral1
Sample
36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe
Resource
win10v2004-20240426-en
Errors
General
-
Target
36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe
-
Size
4.6MB
-
MD5
3163018748a2654f8a4f163ddef28a70
-
SHA1
578ff40fcf01877dd1f481f556d1c97b5e50c191
-
SHA256
36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a
-
SHA512
db6bcff1a28560d696cff104bdf87787e4673f22489257ff77f8ab14a71d3aeb568b0c1a8df32b8e1cb17d05e6fa339a7261761c8dde0845f697023eef76b07d
-
SSDEEP
98304:/kUz/fTQSl103cP+7AVqETc5X0XxzXsVrFrJ24fiE:lzvl10PA4MM0Xxzw2Op
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exedescription ioc process File opened for modification \??\PhysicalDrive0 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe -
Processes:
36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exeWMIC.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe Token: SeIncreaseQuotaPrivilege 2696 WMIC.exe Token: SeSecurityPrivilege 2696 WMIC.exe Token: SeTakeOwnershipPrivilege 2696 WMIC.exe Token: SeLoadDriverPrivilege 2696 WMIC.exe Token: SeSystemProfilePrivilege 2696 WMIC.exe Token: SeSystemtimePrivilege 2696 WMIC.exe Token: SeProfSingleProcessPrivilege 2696 WMIC.exe Token: SeIncBasePriorityPrivilege 2696 WMIC.exe Token: SeCreatePagefilePrivilege 2696 WMIC.exe Token: SeBackupPrivilege 2696 WMIC.exe Token: SeRestorePrivilege 2696 WMIC.exe Token: SeShutdownPrivilege 2696 WMIC.exe Token: SeDebugPrivilege 2696 WMIC.exe Token: SeSystemEnvironmentPrivilege 2696 WMIC.exe Token: SeRemoteShutdownPrivilege 2696 WMIC.exe Token: SeUndockPrivilege 2696 WMIC.exe Token: SeManageVolumePrivilege 2696 WMIC.exe Token: 33 2696 WMIC.exe Token: 34 2696 WMIC.exe Token: 35 2696 WMIC.exe Token: SeIncreaseQuotaPrivilege 2696 WMIC.exe Token: SeSecurityPrivilege 2696 WMIC.exe Token: SeTakeOwnershipPrivilege 2696 WMIC.exe Token: SeLoadDriverPrivilege 2696 WMIC.exe Token: SeSystemProfilePrivilege 2696 WMIC.exe Token: SeSystemtimePrivilege 2696 WMIC.exe Token: SeProfSingleProcessPrivilege 2696 WMIC.exe Token: SeIncBasePriorityPrivilege 2696 WMIC.exe Token: SeCreatePagefilePrivilege 2696 WMIC.exe Token: SeBackupPrivilege 2696 WMIC.exe Token: SeRestorePrivilege 2696 WMIC.exe Token: SeShutdownPrivilege 2696 WMIC.exe Token: SeDebugPrivilege 2696 WMIC.exe Token: SeSystemEnvironmentPrivilege 2696 WMIC.exe Token: SeRemoteShutdownPrivilege 2696 WMIC.exe Token: SeUndockPrivilege 2696 WMIC.exe Token: SeManageVolumePrivilege 2696 WMIC.exe Token: 33 2696 WMIC.exe Token: 34 2696 WMIC.exe Token: 35 2696 WMIC.exe Token: SeIncreaseQuotaPrivilege 2468 WMIC.exe Token: SeSecurityPrivilege 2468 WMIC.exe Token: SeTakeOwnershipPrivilege 2468 WMIC.exe Token: SeLoadDriverPrivilege 2468 WMIC.exe Token: SeSystemProfilePrivilege 2468 WMIC.exe Token: SeSystemtimePrivilege 2468 WMIC.exe Token: SeProfSingleProcessPrivilege 2468 WMIC.exe Token: SeIncBasePriorityPrivilege 2468 WMIC.exe Token: SeCreatePagefilePrivilege 2468 WMIC.exe Token: SeBackupPrivilege 2468 WMIC.exe Token: SeRestorePrivilege 2468 WMIC.exe Token: SeShutdownPrivilege 2468 WMIC.exe Token: SeDebugPrivilege 2468 WMIC.exe Token: SeSystemEnvironmentPrivilege 2468 WMIC.exe Token: SeRemoteShutdownPrivilege 2468 WMIC.exe Token: SeUndockPrivilege 2468 WMIC.exe Token: SeManageVolumePrivilege 2468 WMIC.exe Token: 33 2468 WMIC.exe Token: 34 2468 WMIC.exe Token: 35 2468 WMIC.exe Token: SeIncreaseQuotaPrivilege 2468 WMIC.exe Token: SeSecurityPrivilege 2468 WMIC.exe Token: SeTakeOwnershipPrivilege 2468 WMIC.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exepid process 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exepid process 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.execmd.execmd.exedescription pid process target process PID 1904 wrote to memory of 2712 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe PID 1904 wrote to memory of 2712 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe PID 1904 wrote to memory of 2712 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe PID 1904 wrote to memory of 2712 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe PID 2712 wrote to memory of 2696 2712 cmd.exe WMIC.exe PID 2712 wrote to memory of 2696 2712 cmd.exe WMIC.exe PID 2712 wrote to memory of 2696 2712 cmd.exe WMIC.exe PID 2712 wrote to memory of 2696 2712 cmd.exe WMIC.exe PID 1904 wrote to memory of 2500 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe PID 1904 wrote to memory of 2500 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe PID 1904 wrote to memory of 2500 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe PID 1904 wrote to memory of 2500 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe PID 2500 wrote to memory of 2468 2500 cmd.exe WMIC.exe PID 2500 wrote to memory of 2468 2500 cmd.exe WMIC.exe PID 2500 wrote to memory of 2468 2500 cmd.exe WMIC.exe PID 2500 wrote to memory of 2468 2500 cmd.exe WMIC.exe PID 1904 wrote to memory of 2760 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe PID 1904 wrote to memory of 2760 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe PID 1904 wrote to memory of 2760 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe PID 1904 wrote to memory of 2760 1904 36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe"C:\Users\Admin\AppData\Local\Temp\36d695e2dc5f58e1766c4e77a41414491e87eca29e0c249a7c4fc91866f3b21a.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic path Win32_ComputerSystemProduct get uuid /value2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path Win32_ComputerSystemProduct get uuid /value3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic path Win32_ComputerSystemProduct get uuid /value2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path Win32_ComputerSystemProduct get uuid /value3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c wmic path Win32_ComputerSystemProduct get uuid /value2⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵