096f36981c1424d9e815be4fef0b11c1ad9b32bec9ad0e94b91c749d42e89905

Reason

Machine shutdown

General

Target
spooferrr.exe
Size 821KB
Sample260916-xd1b7sthph
SHA256 096f36981c1424d9e815be4fef0b11c1ad9b32bec9ad0e94b91c749d42e89905
MD5 944312c509c41a68f28fec3133b0e2f3
SHA1 05686f33da9797159681e629848d94d1cb4e3692
SHA512 5c4dfff43ba087a0e56a08d279fa0abd9908d7a4c9b73c6308ff3feddfaa4795e6d56fbebc9499608a9e2a5c910acec54fb848b0af1f5ec050e104ee028bfe97
SSDEEP 24576:paTV9+L5rcO5kWoOlh6PWpJa4hHmW7K8P3pyIH:p8EiO5AGWWraIHhjY4
TLSH
T198052307F68119BBD4C37B7895A873AC0B72DCB666650B23F7FA181B7C21934E95014A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\kutucuvs.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\kutucuvs.sys	cmd.exe
File created	C:\Windows\SysWOW64\vskutu.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\vskutu.sys	cmd.exe
File created	C:\Windows\SysWOW64\kutuas.sys	cmd.exe
File opened for modification	C:\Windows\SysWOW64\kutuas.sys	cmd.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4516	sc.exe
2652	sc.exe
5468	sc.exe
4880	sc.exe
3532	sc.exe
5052	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1428	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spooferrr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
6120	timeout.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1688	shutdown.exe
Token: SeRemoteShutdownPrivilege	1688	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4616	LogonUI.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5680 wrote to memory of 1428	5680	spooferrr.exe	87
PID 1428 wrote to memory of 5052	1428	cmd.exe	89
PID 1428 wrote to memory of 4516	1428	cmd.exe	90
PID 1428 wrote to memory of 2652	1428	cmd.exe	92
PID 1428 wrote to memory of 5468	1428	cmd.exe	93
PID 1428 wrote to memory of 4880	1428	cmd.exe	94
PID 1428 wrote to memory of 3532	1428	cmd.exe	95
PID 1428 wrote to memory of 6120	1428	cmd.exe	96
PID 1428 wrote to memory of 1688	1428	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\spooferrr.exe
"C:\Users\Admin\AppData\Local\Temp\spooferrr.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7z8EF3A630\spooferrr.bat" "
  2⤵
  - Drops file in System32 directory
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\sc.exe
    sc create kutucuvs binPath= "C:\Windows\System32\kutucuvs.sys" DisplayName= "kutucuvs" start= boot tag= 2 type= kernel group= "System Reserved"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5052
- - C:\Windows\SysWOW64\sc.exe
    sc start kutucuvs
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4516
- - C:\Windows\SysWOW64\sc.exe
    sc create vskutu binPath= "C:\Windows\System32\vskutu.sys" DisplayName= "vskutu" start= boot tag= 2 type= kernel group= "System Reserved"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2652
- - C:\Windows\SysWOW64\sc.exe
    sc start vskutu
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5468
- - C:\Windows\SysWOW64\sc.exe
    sc create kutuas binPath= "C:\Windows\System32\kutuas.sys" DisplayName= "kutuas" start= boot tag= 2 type= kernel group= "System Reserved"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4880
- - C:\Windows\SysWOW64\sc.exe
    sc start kutuas
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3532
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:6120
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /r /t 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1688

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2b055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kutuas.sys

Path C:\Users\Admin\AppData\Local\Temp\7z8EF3A630\kutuas.sys
Size 528KB
SHA256 e1a9f811f742bbdb6ea63fc30ec6b9f01592c73c677f849fb398447156952bd4
MD5 8bf0da3b94b3ef091bc23c83c5030f33
SHA1 2595fc700f06f41555a3e1582243ac26ee33dff4
SHA512 7b17cdea5cea8fcb0fc010b374eb0f467c8a07d4d2d31fa2b0ac379f6014b97a90daee2824301c864adaf97090b2a574984af30224460228b31c1593bc54581d
SSDEEP 6144:361FnpyQP+LFbLyXUpsf0zilCZMvxzInS+hyD1/X7KzB+IwRqLwod/YC7J/G+nh2:OTPYJLyHJHY4afG
TLSH
T1C0B43FA62DFEA41A926D9064A20A9FF78E32F8550714FAF320D856FC33F5881245D377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kutucuvs.sys

Path C:\Users\Admin\AppData\Local\Temp\7z8EF3A630\kutucuvs.sys
Size 835KB
SHA256 65dc75921d43bb73f06ed27fb8dc9b4f92234ccbbc8dd180c68f94e5be565bad
MD5 15abf6dac1cccf53b556e656554c8084
SHA1 15f808e447708994a006275008ac88b1fcf2ab93
SHA512 9524ea4b68ada654b1e7625efdfd77b86ea31c8bb42cfb7c753bee9d6e347904e49d89c8309acd435a387009904ff7dc75101c62bd555deb054cfe5ecce96d94
SSDEEP 12288:4ZkLp+d1p2MFbaKcgezri72mFQDOOISl8xxW8hCzhOjeo7Bs3SLQ:zl+d1RbaprcFrOsnRjD7KR
TLSH
T1CA05D012EF10650AC7EF50B6C18CA50B62E7D9618E10EFD7B85A890BE53D4CD767223B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spooferrr.bat

Path C:\Users\Admin\AppData\Local\Temp\7z8EF3A630\spooferrr.bat
Size 2KB
SHA256 d8379427a991ee024dadd93ae1b184446282f0b01d76288f639f54cc63230e6f
MD5 93de52c477b676bf97546efeee3913cc
SHA1 0ca9a1213a42c9cec18700e1220b249dd89f6575
SHA512 192bbafacf0313d1e056371f6b3005998dfc8767c2ed2bae40af0e43341b27edc1aada5a9e7234a3d466cf38942eda95ff852f342317fbfeec3df64b1141707f
TLSH
T17741A0233431AD0C53909AC68EC65651725093479ED71EE0F8CFB372EB51DC366B4DA8
MD5 SHA1 SHA512 TLSH

Submit Download

vskutu.sys

Path C:\Users\Admin\AppData\Local\Temp\7z8EF3A630\vskutu.sys
Size 583KB
SHA256 156b816c0a90d6860c3cd9ad3dc00bc504c68e67f29f8436fd7adf8b287fd348
MD5 8e3d7efae4fca762d3db14e8a2345ad4
SHA1 b68bcca47137653a36c3f0a66d306227550830e4
SHA512 b22da9b73d86e20c4183b29e2a00dd1cdf0fbdc61c45c89c525c93394891f7ba5c3ae256c68b160a708eed77922ee2f83765d93b0271d2e6a68e0b170397c23b
SSDEEP 12288:m9Q3xEVbPWVtjrlyPNoFSWJiyX/gBt0cvTC5npYoFe4H:m9Q3xEVbPWVtjrlyPNoFSWJiyu0c
TLSH
T100C4626661F9E153B26CD8A0E359EB939F04759D121C2AF761F8CAD033A1CC2626C377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads