bf98814452e1a57d18e799f3a59a035806edf20cc62735c07f87d5d50cf61721

Analysis

max time kernel
10s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 02:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe
Size 178KB
Sample240614-c42yhasdjf
SHA256 c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739
MD5 b631c18db90712b27ef786be87a7ea58
SHA1 605f0778534950816d2fd6bb7a625b858aa9948d
SHA512 ac35b6d119ba32aca21ffb50586380ca5ddc73877c35b1b0e2507031c4d48e6d414302062cfebca53a45718105e0567f89c6d0123049fb8eb5dd006c15bd6587
SSDEEP 3072:H+MjfRiAabwOBTgGxU8OSY4TX/z5A65N1AJJn5Jt+BEN22vrn7MyMMQr28C43wI6:H+MjRiAabfBTnS8OD4TX/z5rj1Abn5JD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bootkit discovery evasion exploit persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
4504	takeown.exe
3392	icacls.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4504	takeown.exe
3392	icacls.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4504	takeown.exe
Token: SeShutdownPrivilege	4308	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 2432	4308	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	82
PID 4308 wrote to memory of 2432	4308	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	82
PID 4308 wrote to memory of 2432	4308	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	82
PID 2432 wrote to memory of 4504	2432	cmd.exe	83
PID 2432 wrote to memory of 4504	2432	cmd.exe	83
PID 2432 wrote to memory of 4504	2432	cmd.exe	83
PID 4308 wrote to memory of 3776	4308	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	84
PID 4308 wrote to memory of 3776	4308	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	84
PID 4308 wrote to memory of 3776	4308	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe	84
PID 3776 wrote to memory of 3392	3776	cmd.exe	85
PID 3776 wrote to memory of 3392	3776	cmd.exe	85
PID 3776 wrote to memory of 3392	3776	cmd.exe	85

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe

C:\Users\Admin\AppData\Local\Temp\c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe
"C:\Users\Admin\AppData\Local\Temp\c8bed7421112956dbbd788bf44db97d99c5353bb46d2e5d2e1be4a9a577e8739.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c takeown /f C:\Windows\System32\consent.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\takeown.exe
    takeown /f C:\Windows\System32\consent.exe
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls C:\Windows\System32\consent.exe /deny SYSTEM:F
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Windows\System32\consent.exe /deny SYSTEM:F
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3392