8c648bd94a5a6fa9f06f6b3c4853d0b876298096a6dbb2073f9ec7f966a23813

General

Target
Marijuana.exe
Size 522KB
Sample260906-znvwksseqg
SHA256 8c648bd94a5a6fa9f06f6b3c4853d0b876298096a6dbb2073f9ec7f966a23813
MD5 af831cf6653bbb61c890ddf11c8bbb76
SHA1 224deaf6bdf74ca450972eeb6038d084cb9d4e63
SHA512 ef00cb29cffeb649aa4a6feb3903cc4a9cfb569bb0a6c52751f6dcccbd8f30ab02c6ac6e897a2db2d11ce727ba19a6df3768e5b8ec454d26657aa58706202b64
SSDEEP 12288:hS4Mql2YwA4DEasC7Kq9nRpljl7qYZFar:hSNI544azjlRpfG
TLSH
T117B4BF96BDC6CC92CA222A3089B1E1F1993EBE21DD15851777883F5DFF30D995C20BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery execution persistence

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Marijuana.exe

Disables Task Manager via registry modification
defense_evasion

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	Marijuana.exe

Executes dropped EXE 1 IoCs

pid	Process
3728	mbr.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Marijuana.exe
File opened for modification	\??\PhysicalDrive0	mbr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4332	cmd.exe
2688	cmd.exe
4660	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbr.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4420	Marijuana.exe
Token: SeDebugPrivilege	4420	Marijuana.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4660	4420	Marijuana.exe	85
PID 4420 wrote to memory of 2688	4420	Marijuana.exe	86
PID 4420 wrote to memory of 4332	4420	Marijuana.exe	87
PID 2688 wrote to memory of 1800	2688	cmd.exe	92
PID 4660 wrote to memory of 4804	4660	cmd.exe	93
PID 4332 wrote to memory of 1636	4332	cmd.exe	94
PID 4420 wrote to memory of 3728	4420	Marijuana.exe	95

C:\Users\Admin\AppData\Local\Temp\Marijuana.exe
"C:\Users\Admin\AppData\Local\Temp\Marijuana.exe"
1⤵
- Disables RegEdit via registry modification
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C reg delete HKCR /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\system32\reg.exe
    reg delete HKCR /f
    3⤵
    PID:4804
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C reg delete HKU /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\reg.exe
    reg delete HKU /f
    3⤵
    PID:1800
- C:\Windows\SYSTEM32\cmd.exe
  "cmd.exe" /C reg delete HKCC /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\system32\reg.exe
    reg delete HKCC /f
    3⤵
    PID:1636
- C:\Users\Admin\AppData\Local\Temp\mbr.exe
  "C:\Users\Admin\AppData\Local\Temp\mbr.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  PID:3728

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x374 0x2ec
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mbr.exe

Path C:\Users\Admin\AppData\Local\Temp\mbr.exe
Size 93KB
SHA256 bc6f0280660a7f2434bad3621f9b50ba9d214458b5bccbd6a69dd93988407dff
MD5 245093ef4cfa3c0dccbefa4acbbe6bff
SHA1 c1fae1ef19a1fc9868f5dd2ae9967240076c45ae
SHA512 4affe79442799d093050c001fab37a95418590c5fcdda912e2bc0f7176d4e8d48bd9d2831c46d03e2d13edc66d34e2d1b7855d27d3a399744293f1929106d191
SSDEEP 1536:CmwoXyoci5SjY3SaRO7IPqifrJxdhGZCJjmGasWhQcdQ5/hO2oNxO6:Tv5MYRIMPqiTJx+ZqreRQ5/hXoj
TLSH
T1BA936C43B5D28CB2E5721D3148B1C9A19A6FB9210F648E6B6798137D1F340D0AE39FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp1922.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp1922.tmp
Size 368KB
SHA256 ddca856fbcd1c7fc94c8a297e035f6e2ef2ba7b1cce31e078a149bd8c0760696
MD5 1d250bc56a63fe4fb3f9733b50126ad0
SHA1 595912acf4f530bc4696c2cc47e6bd4454df56c5
SHA512 e1b6cecbb7fd49467fad2a0aca2368407e05220358c701d6c3af1500d0ae248a49f66c55b38297d5cc3f4a40bbc2b348d0d4854bcf9e9ade2d9883615bd0af9c
SSDEEP 6144:5jKjD5AXSysY/ZmvnLo6Ihg6gr4CYtng9SQ6oXe1952K9K/VOBh3O8JfiQt:th9dgGma9K/eh3dfxt
TLSH
T104842B873EA5D61BCB4307744DA32342B33DE4C4879DDB078E50A4318E9A71F99E9AC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4420-0-0x0000020B174D0000-0x0000020B17558000-memory.dmp

Download

memory/4420-1-0x0000020B17910000-0x0000020B17920000-memory.dmp

Download

memory/4420-475-0x0000020B17910000-0x0000020B17920000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads