553e2e3f67cb6b16bb7fab819c71bf832f56d155da66d9a7e00804f967a4cc8e

Reason

Machine shutdown

General

Target
JohnFrez3Spoofer.exe
Size 1006KB
Sample261014-wf87fshb75
SHA256 553e2e3f67cb6b16bb7fab819c71bf832f56d155da66d9a7e00804f967a4cc8e
MD5 097bf42a736e1cf70b8b7e966faa9393
SHA1 573f5146baf5ab12e271658d5bc50780f517ca06
SHA512 1a5ad0116b3595bd726c23241feb75a8fb8fc7ea903ca7a9d082444a91bdd695fa8a39593258ccabec2092a1eb1d45b87acd1bf52c9da2775184cee28c79acb2
SSDEEP 24576:qXyyBU4q1zSq2kYr6mNIWHil/a8BCjheH+O6z8x:sn24K2q2kYrWta8CE6z8x
TLSH
T167251212E37620EDF0B2D57989A62742F23378154B309BDF8750866A5F237E4AC39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\n5rzi7lrvuu.sys	JohnFrez3Spoofer.exe
File opened for modification	C:\Windows\system32\n5rzi7lrvuu.sys	JohnFrez3Spoofer.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2684	sc.exe
912	sc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	JohnFrez3Spoofer.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2896	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	JohnFrez3Spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	JohnFrez3Spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber	JohnFrez3Spoofer.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "30"	LogonUI.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	684	shutdown.exe
Token: SeRemoteShutdownPrivilege	684	shutdown.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2052	JohnFrez3Spoofer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4600	LogonUI.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2896	2052	JohnFrez3Spoofer.exe	94
PID 2896 wrote to memory of 2684	2896	cmd.exe	96
PID 2896 wrote to memory of 912	2896	cmd.exe	97
PID 2896 wrote to memory of 684	2896	cmd.exe	98

C:\Users\Admin\AppData\Local\Temp\JohnFrez3Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\JohnFrez3Spoofer.exe"
1⤵
- Drops file in System32 directory
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jnf_fsrldyrk2otabnh.bat" "n5rzi7lrvuu" "" "" "n5rzi7lrvuu.sys" "" "" 0"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\system32\sc.exe
    sc create n5rzi7lrvuu binPath= "C:\Windows\System32\n5rzi7lrvuu.sys" DisplayName= "n5rzi7lrvuu" start= boot tag= 2 type= kernel group= "System Reserved"
    3⤵
    - Launches sc.exe
    PID:2684
- - C:\Windows\system32\sc.exe
    sc start n5rzi7lrvuu
    3⤵
    - Launches sc.exe
    PID:912
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 0 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:684

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b3855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Direct Volume Access

1

T1006

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jnf_fsrldyrk2otabnh.bat

Path C:\Users\Admin\AppData\Local\Temp\jnf_fsrldyrk2otabnh.bat
Size 1KB
SHA256 326f6843bbe3d4742c377384363eda84a0f33671fa75ee4ed5673b61bb870f50
MD5 b1bfef23ed33a9e9fed5e214127be84f
SHA1 e398e5e23528ec1b78274d0a5ed36b8ac663da08
SHA512 90b372e22c4cd3cdab652a3b51385b74f210b96f2e22457af5638db61e93e176770a180de7f7bb829763989d91653a4e309d7df64c4c15b47dc7c0bef84ce6db
TLSH
T12731EA970A0CEDC9201882FB1945FB20698D659740A4CFF8BCCE2484AFD64A395F15FC
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

Errors