Analysis
-
max time kernel
2s -
max time network
3s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 12:47
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe
Resource
win10v2004-20240508-en
Errors
General
-
Target
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe
-
Size
720KB
-
MD5
28c80739400645b392c9ec6ac2c3fcd4
-
SHA1
0b0349a348e8f83e8de11192d66b6ed0ce3e6166
-
SHA256
e9843f3485755bf3f2bb45c8252dd5df87f7c943840c65a05143442d04f9672c
-
SHA512
59cd587b4d40d842f6f4ce6fe2f95ad9b422fd7c72729585f2102ef539c24aaf99598f6b3df5f36ba831e2aefa733e6dfde8d693e4b11a2e49a05148e95a04a4
-
SSDEEP
12288:SaSuG9f+BgntpABY2ATt2rwTZni5KytexQvt:SaWf+enjABY2Ax2rwTZiUyteM
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Program Files\\System.dll" 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exedescription ioc process File opened for modification \??\physicaldrive0 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe -
Drops file in Program Files directory 3 IoCs
Processes:
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exedescription ioc process File created C:\Program Files\360.dll 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe File created C:\Program Files\System.dll 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe File opened for modification C:\Program Files\System.dll 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe -
Modifies data under HKEY_USERS 15 IoCs
Processes:
LogonUI.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "217" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exedescription pid process Token: SeShutdownPrivilege 1640 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exeLogonUI.exepid process 1640 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe 1640 2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe 3372 LogonUI.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_28c80739400645b392c9ec6ac2c3fcd4_mbrlock_xiaoba.exe"1⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1640
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa399a855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3372