1d677dcfd9331ff66227138ef4441c762b1335a72d29d99d3f8925dbd046cde4

Analysis

max time kernel
139s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7boot.exe
Size

264KB
MD5

b1e7a0ab4fe9186aece0cd7d0f96f569
SHA1

82570041e123b1b078cf8daa6da77450ceee5978
SHA256

e42ff63a5e2066de32e0f1121dc3e90b6810fa0af2aee5f760e3486375fbae55
SHA512

8806ab4dcacd01d9e13af8b6eb5311dadba7d58413559eceed2d28a44c2ef10729d4d4bb39616099e0bcf2f095ef3abc19a80661363ade009315f548c6ab2ccb
SSDEEP

6144:2zG8nriOnW/rGgGcHkf3LrMOdHY6C3LBo1Ov2yoLK0:O1DYrVkf3L3NY56/j

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	7boot.exe

Executes dropped EXE 1 IoCs

pid	Process
1432	Win7BootUpdaterCmd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Skin Pack\Lion\Win7BootUpdaterCmd.exe	7boot.exe
File opened for modification	C:\Program Files (x86)\Skin Pack\Lion\unistall.cmd	7boot.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7boot.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Win7BootUpdaterCmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dw20.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3972	dw20.exe
Token: SeBackupPrivilege	3972	dw20.exe
Token: SeBackupPrivilege	3972	dw20.exe
Token: SeBackupPrivilege	3972	dw20.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3916	2128	7boot.exe	89
PID 2128 wrote to memory of 3916	2128	7boot.exe	89
PID 2128 wrote to memory of 3916	2128	7boot.exe	89
PID 3916 wrote to memory of 1432	3916	cmd.exe	92
PID 3916 wrote to memory of 1432	3916	cmd.exe	92
PID 3916 wrote to memory of 1432	3916	cmd.exe	92
PID 1432 wrote to memory of 3972	1432	Win7BootUpdaterCmd.exe	93
PID 1432 wrote to memory of 3972	1432	Win7BootUpdaterCmd.exe	93
PID 1432 wrote to memory of 3972	1432	Win7BootUpdaterCmd.exe	93

C:\Users\Admin\AppData\Local\Temp\7boot.exe
"C:\Users\Admin\AppData\Local\Temp\7boot.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Skin Pack\Lion\unistall.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Program Files (x86)\Skin Pack\Lion\Win7BootUpdaterCmd.exe
    Win7BootUpdaterCmd /restore
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
      dw20.exe -x -s 908
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious use of AdjustPrivilegeToken
      PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Skin Pack\Lion\Win7BootUpdaterCmd.exe

Filesize
272KB

MD5
4c26092f628205e2a8302c190d5f12bc

SHA1
c7474941ed2a3dbb02e12040595ea9cd56145e01

SHA256
b3674e5f0693201bc7d55005220fe26753baf833d86e75f2363a5dbdb2480ed1

SHA512
e4bcf831261253140a33265c8ae51b77f9f5f6ecfa914f313824bf199e8f2131b9df7e4adf3430c0850e234d731f4774ace7b7e6c82176ce1a6e4f8fab3cb49e

Download Submit
C:\Program Files (x86)\Skin Pack\Lion\unistall.cmd

Filesize
27B

MD5
b1ce10f72a52820540050951c6154f53

SHA1
f7230ff1efc5591b3fbb6ea121f9121a4b467db3

SHA256
6231cd409972524bb08297919786447d56ca6c26fcd34b82d9bc6c5018887d4f

SHA512
270d0d9fd15a7e6d8809c10bceefc5b0e117bf579a1944bd9a98289c480067c606c353eb17001899eb956d4dd3af175dc7bd4603c35e438fb07f96c5e4526169

Download Submit
memory/1432-19-0x0000000072772000-0x0000000072773000-memory.dmp

Filesize
4KB

Download
memory/1432-20-0x0000000072770000-0x0000000072D21000-memory.dmp

Filesize
5.7MB

Download
memory/1432-21-0x0000000072770000-0x0000000072D21000-memory.dmp

Filesize
5.7MB

Download
memory/1432-22-0x0000000072770000-0x0000000072D21000-memory.dmp

Filesize
5.7MB

Download
memory/1432-29-0x0000000072770000-0x0000000072D21000-memory.dmp

Filesize
5.7MB

Download
memory/2128-31-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads