e9ae48329c10ec833b4218e4d88bfb4904b8d434ae0dd5d92de9f2c2ec66e238

Reason

Machine shutdown

General

Target
e9ae48329c10ec83.exe
Size 13.2MB
Sample260802-zz88caxtev
SHA256 e9ae48329c10ec833b4218e4d88bfb4904b8d434ae0dd5d92de9f2c2ec66e238
MD5 62b1047a2a0f54b1509f9c25a42bf8a0
SHA1 af38ad991e095c9cd33d1b5351f2b0132fc8f624
SHA512 a290b7c58f885dde2cdad21ac6546f7b05485250e68b099cabff3e81d7daaac0a423adcf3bc802a78f768d74e289c72dfebfb530d9fe622ccbf558dbdd078548
SSDEEP 196608:aR0iYsShSHrlPK2PWg2I9tjptNCCDUGfZG26cwCUMh4b:i00S4PdbL1Ffx5bUMh6
TLSH
T101D65A207246823EF99705F05879A69A5338AE2E071F50CB6DD43E68DD736CE27326D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	e9ae48329c10ec83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e9ae48329c10ec83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	e9ae48329c10ec83.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e9ae48329c10ec83.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	e9ae48329c10ec83.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4232	4500	WerFault.exe	94

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9ae48329c10ec83.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9ae48329c10ec83.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9ae48329c10ec83.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4168	schtasks.exe
5824	schtasks.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4376	e9ae48329c10ec83.exe
Token: SeDebugPrivilege	4500	e9ae48329c10ec83.exe
Token: SeDebugPrivilege	2536	e9ae48329c10ec83.exe
Token: SeDebugPrivilege	4500	e9ae48329c10ec83.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 4168	4376	e9ae48329c10ec83.exe	90
PID 4376 wrote to memory of 2448	4376	e9ae48329c10ec83.exe	92
PID 2536 wrote to memory of 5824	2536	e9ae48329c10ec83.exe	98
PID 2536 wrote to memory of 2016	2536	e9ae48329c10ec83.exe	100
PID 4376 wrote to memory of 4900	4376	e9ae48329c10ec83.exe	102
PID 2536 wrote to memory of 3184	2536	e9ae48329c10ec83.exe	105

System policy modification 1 TTPs 3 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	e9ae48329c10ec83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	e9ae48329c10ec83.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	e9ae48329c10ec83.exe

C:\Users\Admin\AppData\Local\Temp\e9ae48329c10ec83.exe
"C:\Users\Admin\AppData\Local\Temp\e9ae48329c10ec83.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /RL HIGHEST /SC ONCE /TN MyTask /TR "C:\Users\Admin\AppData\Local\Temp\e9ae48329c10ec83.exe" /ST 22:10:39 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4168
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Run /TN MyTask
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2448
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Delete /TN MyTask /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4900

C:\Users\Admin\AppData\Local\Temp\e9ae48329c10ec83.exe
"C:\Users\Admin\AppData\Local\Temp\e9ae48329c10ec83.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 1140
  2⤵
  - Program crash
  PID:4232

C:\Users\Admin\AppData\Local\Temp\e9ae48329c10ec83.exe
C:\Users\Admin\AppData\Local\Temp\e9ae48329c10ec83.exe
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /RL HIGHEST /SC ONCE /TN MyTask /TR "C:\Users\Admin\AppData\Local\Temp\e9ae48329c10ec83.exe" /ST 22:10:40 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:5824
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Run /TN MyTask
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2016
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Delete /TN MyTask /F
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3184