Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 19:36
Static task
static1
Behavioral task
behavioral1
Sample
Reader.lnk
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Reader.lnk
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
red.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
red.exe
Resource
win10v2004-20240802-en
General
-
Target
Reader.lnk
-
Size
2KB
-
MD5
66bb9363e23c7ef2d16c89cd654b491e
-
SHA1
c20e8d536804cf97584eec93d9a89c09541155bc
-
SHA256
61f36c5ae038faa2b58a9a17b464d01414b4265e46634f353319c471d0a35789
-
SHA512
b7a751e49218230d574ca9cc4cbbb1995d89798268124b1617889c7558c66902f81fdb77a299edcc6d96452cec81adb76768172710e00c9272d30821ab0089c5
Malware Config
Signatures
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 1604 bcdedit.exe 2784 bcdedit.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exered.exepid process 2612 powershell.exe 2612 powershell.exe 2612 powershell.exe 2604 red.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exered.exedescription pid process Token: SeDebugPrivilege 2612 powershell.exe Token: SeTakeOwnershipPrivilege 2604 red.exe Token: SeDebugPrivilege 2604 red.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
cmd.exepowershell.exered.execmd.execmd.exedescription pid process target process PID 2272 wrote to memory of 2612 2272 cmd.exe powershell.exe PID 2272 wrote to memory of 2612 2272 cmd.exe powershell.exe PID 2272 wrote to memory of 2612 2272 cmd.exe powershell.exe PID 2612 wrote to memory of 2604 2612 powershell.exe red.exe PID 2612 wrote to memory of 2604 2612 powershell.exe red.exe PID 2612 wrote to memory of 2604 2612 powershell.exe red.exe PID 2604 wrote to memory of 2640 2604 red.exe cmd.exe PID 2604 wrote to memory of 2640 2604 red.exe cmd.exe PID 2604 wrote to memory of 2640 2604 red.exe cmd.exe PID 2604 wrote to memory of 3052 2604 red.exe cmd.exe PID 2604 wrote to memory of 3052 2604 red.exe cmd.exe PID 2604 wrote to memory of 3052 2604 red.exe cmd.exe PID 2640 wrote to memory of 1604 2640 cmd.exe bcdedit.exe PID 2640 wrote to memory of 1604 2640 cmd.exe bcdedit.exe PID 2640 wrote to memory of 1604 2640 cmd.exe bcdedit.exe PID 3052 wrote to memory of 2784 3052 cmd.exe bcdedit.exe PID 3052 wrote to memory of 2784 3052 cmd.exe bcdedit.exe PID 3052 wrote to memory of 2784 3052 cmd.exe bcdedit.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Reader.lnk1⤵
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w hidden -command start red.exe "1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\red.exe"C:\Users\Admin\AppData\Local\Temp\red.exe" 13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} bootstatuspolicy ignoreallfailures4⤵
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} bootstatuspolicy ignoreallfailures5⤵
- Modifies boot configuration data using bcdedit
PID:1604 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c bcdedit /set {current} recoveryenabled no4⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\system32\bcdedit.exebcdedit /set {current} recoveryenabled no5⤵
- Modifies boot configuration data using bcdedit
PID:2784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2612-38-0x000007FEF628E000-0x000007FEF628F000-memory.dmpFilesize
4KB
-
memory/2612-40-0x0000000001CF0000-0x0000000001CF8000-memory.dmpFilesize
32KB
-
memory/2612-39-0x000000001B550000-0x000000001B832000-memory.dmpFilesize
2.9MB
-
memory/2612-41-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmpFilesize
9.6MB
-
memory/2612-42-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmpFilesize
9.6MB
-
memory/2612-44-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmpFilesize
9.6MB
-
memory/2612-43-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmpFilesize
9.6MB
-
memory/2612-45-0x000007FEF5FD0000-0x000007FEF696D000-memory.dmpFilesize
9.6MB