bce721a6081d418d0e00bce7dfb5a6b957767b0138690f7e5d642181556b8296

Analysis

max time kernel
61s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2025, 12:30

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Clutt6.6.6.exe
Size

4.5MB
MD5

ebe2598356ddaa94e3c507a3bf3fbaaf
SHA1

12fbb71303fbad2d1d6b644d67f3d895ed417ea2
SHA256

bce721a6081d418d0e00bce7dfb5a6b957767b0138690f7e5d642181556b8296
SHA512

e541c1e25c081530b7102445d57c70ceaabb3a719ac895b1322305d3b2e0c6d8cd42dbb231285473a48c8221d94cfd3f9aab431a2aaaf551b55b060d83f87552
SSDEEP

98304:jpwhVUMFFWIV5grw46s655grwrI8FFhnhV:Vw0MFsd6s6P3FTn

Score

10^/10

bootkit defense_evasion discovery exploit persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "satan"	Clutt6.6.6.exe

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Clutt6.6.6.exe

Disables Task Manager via registry modification
defense_evasion

Possible privilege escalation attempt 6 IoCs

exploit

pid	Process
3356	takeown.exe
2748	icacls.exe
1124	takeown.exe
3360	icacls.exe
5924	takeown.exe
5556	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	Clutt6.6.6.exe

Modifies file permissions 1 TTPs 6 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1124	takeown.exe
3360	icacls.exe
5924	takeown.exe
5556	icacls.exe
3356	takeown.exe
2748	icacls.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Clutt6.6.6.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Temp\mirror_snd.wav	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\static_color.wav	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\wind_snd.wav	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\clutterus_ico.ico	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\crossHD_medium.ico	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\invert_snd.wav	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\plg.wav	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\rainbow_snd.wav	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\stretch.wav	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\tunnel.wav	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\wind_edit.wav	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\wind_short.wav	Clutt6.6.6.exe
File opened for modification	C:\Program Files\Temp\crossHD_small.ico	Clutt6.6.6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe
216	Clutt6.6.6.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	216	Clutt6.6.6.exe
Token: SeDebugPrivilege	216	Clutt6.6.6.exe
Token: SeTakeOwnershipPrivilege	3356	takeown.exe
Token: SeTakeOwnershipPrivilege	1124	takeown.exe
Token: SeTakeOwnershipPrivilege	5924	takeown.exe
Token: 33	1164	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1164	AUDIODG.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4596	216	Clutt6.6.6.exe	93
PID 216 wrote to memory of 4596	216	Clutt6.6.6.exe	93
PID 4596 wrote to memory of 3356	4596	cmd.exe	95
PID 4596 wrote to memory of 3356	4596	cmd.exe	95
PID 4596 wrote to memory of 2748	4596	cmd.exe	96
PID 4596 wrote to memory of 2748	4596	cmd.exe	96
PID 4596 wrote to memory of 1124	4596	cmd.exe	99
PID 4596 wrote to memory of 1124	4596	cmd.exe	99
PID 4596 wrote to memory of 3360	4596	cmd.exe	100
PID 4596 wrote to memory of 3360	4596	cmd.exe	100
PID 4596 wrote to memory of 5924	4596	cmd.exe	101
PID 4596 wrote to memory of 5924	4596	cmd.exe	101
PID 4596 wrote to memory of 5556	4596	cmd.exe	102
PID 4596 wrote to memory of 5556	4596	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\Clutt6.6.6.exe
"C:\Users\Admin\AppData\Local\Temp\Clutt6.6.6.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F" && takeown /f C:\Windows\System32\drivers && icacls C:\Windows\System32\drivers /grant "%username%:F" && takeown /f C:\Windows\System32\Boot && icacls C:\Windows\System32\Boot /grant "%username%:F" && exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32 /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2748
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\drivers
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:1124
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\drivers /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:3360
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Windows\System32\Boot
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- - C:\Windows\system32\icacls.exe
    icacls C:\Windows\System32\Boot /grant "Admin:F"
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5556

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f4 0x4b8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1164

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3911055 /state1:0x41c64e6d
1⤵
PID:5124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/216-0-0x00007FFA52FD3000-0x00007FFA52FD5000-memory.dmp

Filesize
8KB

Download
memory/216-1-0x0000000000F70000-0x0000000001400000-memory.dmp

Filesize
4.6MB

Download
memory/216-2-0x00007FFA52FD0000-0x00007FFA53A91000-memory.dmp

Filesize
10.8MB

Download
memory/216-3-0x00007FFA52FD0000-0x00007FFA53A91000-memory.dmp

Filesize
10.8MB

Download
memory/216-17-0x00007FFA52FD3000-0x00007FFA52FD5000-memory.dmp

Filesize
8KB

Download
memory/216-18-0x00007FFA52FD0000-0x00007FFA53A91000-memory.dmp

Filesize
10.8MB

Download
memory/216-22-0x000000001CFB0000-0x000000001CFF6000-memory.dmp

Filesize
280KB

Download
memory/216-27-0x000000001CFB0000-0x000000001CFF6000-memory.dmp

Filesize
280KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads