Overview
overview
10Static
static
3AMI/AMIDEWINx64.exe
windows10-2004-x64
1AMI/amigendrv64.sys
windows10-2004-x64
1AMI/spoof.bat
windows10-2004-x64
1Insyde/H2O...64.exe
windows10-2004-x64
Insyde/segwindrv.cat
windows10-2004-x64
8Insyde/segwindrv.inf
windows10-2004-x64
1Insyde/seg...64.sys
windows10-2004-x64
1Insyde/spoof.bat
windows10-2004-x64
VHD/1.txt
windows10-2004-x64
1VHD/VHD.bat
windows10-2004-x64
1check.bat
windows10-2004-x64
5tweaks/1.bat
windows10-2004-x64
10tweaks/1.reg
windows10-2004-x64
10Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
28/05/2024, 10:23
Static task
static1
Behavioral task
behavioral1
Sample
AMI/AMIDEWINx64.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
AMI/amigendrv64.sys
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
AMI/spoof.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Insyde/H2OSDE-Wx64.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Insyde/segwindrv.cat
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Insyde/segwindrv.inf
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Insyde/segwindrvx64.sys
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Insyde/spoof.bat
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
VHD/1.txt
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
VHD/VHD.bat
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
check.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
tweaks/1.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
tweaks/1.reg
Resource
win10v2004-20240426-en
windows10-2004-x64
General
- Target check.bat
- Size 274B
- Sample240528-mexmlage85
- SHA256 3c36f73644642fa71c86fe48d24cc47f5293cedcec8bd0981d111e5823bda3ea
- MD5 e8db7ba2184c7b20e20182d01522e6c6
- SHA1 877be10ebd8d6281da715d96b4741dddbbd258c3
- SHA512 1024d79d1b3f6208c577b7c45ac8e3a985887736af0712fbec2e54c837c4d6de14afa7dfbe58266d157490952c9a857a402ec3ec393d560d6611273aac55d529
- MD5 SHA1 SHA512
Malware Config
Signatures
- Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\repository\MAPPING3.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\OBJECTS.DATA svchost.exe File opened for modification C:\Windows\system32\wbem\repository\INDEX.BTR svchost.exe File opened for modification C:\Windows\system32\wbem\repository svchost.exe File opened for modification C:\Windows\system32\wbem\repository\WRITABLE.TST svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING1.MAP svchost.exe File opened for modification C:\Windows\system32\wbem\repository\MAPPING2.MAP svchost.exe - Runs net.exe
- Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3032 WMIC.exe Token: SeSecurityPrivilege 3032 WMIC.exe Token: SeTakeOwnershipPrivilege 3032 WMIC.exe Token: SeLoadDriverPrivilege 3032 WMIC.exe Token: SeSystemProfilePrivilege 3032 WMIC.exe Token: SeSystemtimePrivilege 3032 WMIC.exe Token: SeProfSingleProcessPrivilege 3032 WMIC.exe Token: SeIncBasePriorityPrivilege 3032 WMIC.exe Token: SeCreatePagefilePrivilege 3032 WMIC.exe Token: SeBackupPrivilege 3032 WMIC.exe Token: SeRestorePrivilege 3032 WMIC.exe Token: SeShutdownPrivilege 3032 WMIC.exe Token: SeDebugPrivilege 3032 WMIC.exe Token: SeSystemEnvironmentPrivilege 3032 WMIC.exe Token: SeRemoteShutdownPrivilege 3032 WMIC.exe Token: SeUndockPrivilege 3032 WMIC.exe Token: SeManageVolumePrivilege 3032 WMIC.exe Token: 33 3032 WMIC.exe Token: 34 3032 WMIC.exe Token: 35 3032 WMIC.exe Token: 36 3032 WMIC.exe Token: SeAssignPrimaryTokenPrivilege 4720 svchost.exe Token: SeIncreaseQuotaPrivilege 4720 svchost.exe Token: SeSecurityPrivilege 4720 svchost.exe Token: SeTakeOwnershipPrivilege 4720 svchost.exe Token: SeLoadDriverPrivilege 4720 svchost.exe Token: SeSystemtimePrivilege 4720 svchost.exe Token: SeBackupPrivilege 4720 svchost.exe Token: SeRestorePrivilege 4720 svchost.exe Token: SeShutdownPrivilege 4720 svchost.exe Token: SeSystemEnvironmentPrivilege 4720 svchost.exe Token: SeUndockPrivilege 4720 svchost.exe Token: SeManageVolumePrivilege 4720 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4720 svchost.exe Token: SeIncreaseQuotaPrivilege 4720 svchost.exe Token: SeSecurityPrivilege 4720 svchost.exe Token: SeTakeOwnershipPrivilege 4720 svchost.exe Token: SeLoadDriverPrivilege 4720 svchost.exe Token: SeSystemtimePrivilege 4720 svchost.exe Token: SeBackupPrivilege 4720 svchost.exe Token: SeRestorePrivilege 4720 svchost.exe Token: SeShutdownPrivilege 4720 svchost.exe Token: SeSystemEnvironmentPrivilege 4720 svchost.exe Token: SeUndockPrivilege 4720 svchost.exe Token: SeManageVolumePrivilege 4720 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4720 svchost.exe Token: SeIncreaseQuotaPrivilege 4720 svchost.exe Token: SeSecurityPrivilege 4720 svchost.exe Token: SeTakeOwnershipPrivilege 4720 svchost.exe Token: SeLoadDriverPrivilege 4720 svchost.exe Token: SeSystemtimePrivilege 4720 svchost.exe Token: SeBackupPrivilege 4720 svchost.exe Token: SeRestorePrivilege 4720 svchost.exe Token: SeShutdownPrivilege 4720 svchost.exe Token: SeSystemEnvironmentPrivilege 4720 svchost.exe Token: SeUndockPrivilege 4720 svchost.exe Token: SeManageVolumePrivilege 4720 svchost.exe Token: SeAssignPrimaryTokenPrivilege 4720 svchost.exe Token: SeIncreaseQuotaPrivilege 4720 svchost.exe Token: SeSecurityPrivilege 4720 svchost.exe Token: SeTakeOwnershipPrivilege 4720 svchost.exe Token: SeLoadDriverPrivilege 4720 svchost.exe Token: SeSystemtimePrivilege 4720 svchost.exe Token: SeBackupPrivilege 4720 svchost.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 220 wrote to memory of 2400 220 cmd.exe 84 PID 220 wrote to memory of 2400 220 cmd.exe 84 PID 2400 wrote to memory of 1924 2400 net.exe 85 PID 2400 wrote to memory of 1924 2400 net.exe 85 PID 220 wrote to memory of 3032 220 cmd.exe 90 PID 220 wrote to memory of 3032 220 cmd.exe 90 PID 220 wrote to memory of 972 220 cmd.exe 93 PID 220 wrote to memory of 972 220 cmd.exe 93 PID 220 wrote to memory of 4340 220 cmd.exe 94 PID 220 wrote to memory of 4340 220 cmd.exe 94 PID 220 wrote to memory of 2704 220 cmd.exe 95 PID 220 wrote to memory of 2704 220 cmd.exe 95
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\check.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\system32\net.exenet stop winmgmt /y2⤵
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop winmgmt /y3⤵PID:1924
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get manufacturer, product, serialnumber2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3032
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get manufacturer, releasedate, serialnumber2⤵PID:972
-
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get name, uuid2⤵PID:4340
-
-
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber2⤵PID:2704
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4720