553e2e3f67cb6b16bb7fab819c71bf832f56d155da66d9a7e00804f967a4cc8e

Reason

Machine shutdown

General

Target
JohnFrez3Spoofer.exe
Size 1006KB
Sample261014-wf87fshb75
SHA256 553e2e3f67cb6b16bb7fab819c71bf832f56d155da66d9a7e00804f967a4cc8e
MD5 097bf42a736e1cf70b8b7e966faa9393
SHA1 573f5146baf5ab12e271658d5bc50780f517ca06
SHA512 1a5ad0116b3595bd726c23241feb75a8fb8fc7ea903ca7a9d082444a91bdd695fa8a39593258ccabec2092a1eb1d45b87acd1bf52c9da2775184cee28c79acb2
SSDEEP 24576:qXyyBU4q1zSq2kYr6mNIWHil/a8BCjheH+O6z8x:sn24K2q2kYrWta8CE6z8x
TLSH
T167251212E37620EDF0B2D57989A62742F23378154B309BDF8750866A5F237E4AC39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4216	m1mpexpmzh7.sys
696	vdceeval7at.sys
2656	l09o0jvzc7s.sys

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system32\vdceeval7at.sys	JohnFrez3Spoofer.exe
File opened for modification	C:\Windows\system32\vdceeval7at.sys	JohnFrez3Spoofer.exe
File created	C:\Windows\system32\l09o0jvzc7s.sys	JohnFrez3Spoofer.exe
File opened for modification	C:\Windows\system32\l09o0jvzc7s.sys	JohnFrez3Spoofer.exe
File created	C:\Windows\system32\m1mpexpmzh7.sys	JohnFrez3Spoofer.exe
File opened for modification	C:\Windows\system32\m1mpexpmzh7.sys	JohnFrez3Spoofer.exe

Launches sc.exe 6 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4136	sc.exe
5380	sc.exe
700	sc.exe
3700	sc.exe
3160	sc.exe
4212	sc.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	JohnFrez3Spoofer.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1652	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardSerialNumber	JohnFrez3Spoofer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	JohnFrez3Spoofer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	JohnFrez3Spoofer.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5860	shutdown.exe
Token: SeRemoteShutdownPrivilege	5860	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
260	LogonUI.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3400 wrote to memory of 1652	3400	JohnFrez3Spoofer.exe	95
PID 1652 wrote to memory of 5380	1652	cmd.exe	97
PID 1652 wrote to memory of 700	1652	cmd.exe	98
PID 1652 wrote to memory of 3700	1652	cmd.exe	99
PID 1652 wrote to memory of 3160	1652	cmd.exe	100
PID 1652 wrote to memory of 4212	1652	cmd.exe	101
PID 1652 wrote to memory of 4136	1652	cmd.exe	102
PID 1652 wrote to memory of 5860	1652	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\JohnFrez3Spoofer.exe
"C:\Users\Admin\AppData\Local\Temp\JohnFrez3Spoofer.exe"
1⤵
- Drops file in System32 directory
- Direct Volume Access: Opens a physical disk for reading
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\jnf_jpfvy788bb4kfcl.bat" "vdceeval7at" "l09o0jvzc7s" "m1mpexpmzh7" "vdceeval7at.sys" "l09o0jvzc7s.sys" "m1mpexpmzh7.sys" 1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\system32\sc.exe
    sc create vdceeval7at binPath= "C:\Windows\System32\vdceeval7at.sys" DisplayName= "vdceeval7at" start= boot tag= 2 type= kernel group= "System Reserved"
    3⤵
    - Launches sc.exe
    PID:5380
- - C:\Windows\system32\sc.exe
    sc start vdceeval7at
    3⤵
    - Launches sc.exe
    PID:700
- - C:\Windows\system32\sc.exe
    sc create l09o0jvzc7s binPath= "C:\Windows\System32\l09o0jvzc7s.sys" DisplayName= "l09o0jvzc7s" start= boot tag= 2 type= kernel group= "System Reserved"
    3⤵
    - Launches sc.exe
    PID:3700
- - C:\Windows\system32\sc.exe
    sc start l09o0jvzc7s
    3⤵
    - Launches sc.exe
    PID:3160
- - C:\Windows\system32\sc.exe
    sc create m1mpexpmzh7 binPath= "C:\Windows\System32\m1mpexpmzh7.sys" DisplayName= "m1mpexpmzh7" start= boot tag= 2 type= kernel group= "System Reserved"
    3⤵
    - Launches sc.exe
    PID:4212
- - C:\Windows\system32\sc.exe
    sc start m1mpexpmzh7
    3⤵
    - Launches sc.exe
    PID:4136
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 0 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5860

C:\Windows\system32\m1mpexpmzh7.sys
C:\Windows\system32\m1mpexpmzh7.sys
1⤵
- Executes dropped EXE
PID:4216

C:\Windows\system32\vdceeval7at.sys
C:\Windows\system32\vdceeval7at.sys
1⤵
- Executes dropped EXE
PID:696

C:\Windows\system32\l09o0jvzc7s.sys
C:\Windows\system32\l09o0jvzc7s.sys
1⤵
- Executes dropped EXE
PID:2656

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2b855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

System Services

1

T1569

Service Execution

1

T1569.002

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Direct Volume Access

1

T1006

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jnf_jpfvy788bb4kfcl.bat

Path C:\Users\Admin\AppData\Local\Temp\jnf_jpfvy788bb4kfcl.bat
Size 1KB
SHA256 326f6843bbe3d4742c377384363eda84a0f33671fa75ee4ed5673b61bb870f50
MD5 b1bfef23ed33a9e9fed5e214127be84f
SHA1 e398e5e23528ec1b78274d0a5ed36b8ac663da08
SHA512 90b372e22c4cd3cdab652a3b51385b74f210b96f2e22457af5638db61e93e176770a180de7f7bb829763989d91653a4e309d7df64c4c15b47dc7c0bef84ce6db
TLSH
T12731EA970A0CEDC9201882FB1945FB20698D659740A4CFF8BCCE2484AFD64A395F15FC
MD5 SHA1 SHA512 TLSH

Submit Download

l09o0jvzc7s.sys

Path C:\Windows\System32\l09o0jvzc7s.sys
Size 415KB
SHA256 e3c158d520a46623d75d50bbe2a374443bc3d2511703146ed044c812836b49f3
MD5 8f0b0130c4cf8d07dcde7c632714c3ff
SHA1 633960da7d3f9bc984b3bb9c2c578c8f37d73065
SHA512 05645f312e84cbfa3877cefa41a531c1fd156d98c60f297101d00ecb475d534850e6d21ca116085d51c671dd8c1bb6be12505a19d1234e974f3163d3e6546942
SSDEEP 12288:lGvCa1CmL2iySM38ul6KAiIoQ7cBAr+NlG:l9a1CK2ifiK7cJ4
TLSH
T131945B43CF84B6AECB47B635991297101562FD126B120FA269E9B3D4CA326D43F36337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

m1mpexpmzh7.sys

Path C:\Windows\System32\m1mpexpmzh7.sys
Size 412KB
SHA256 7df82844e9216dfb06ab3fc2eeb7bcc956d6b7b0aa3d1cd25e70eb25a8b5b765
MD5 95dd93af6b1e1f83a1b2a18a703989f7
SHA1 cbbf1147af1390f87cc6bee1cf83aa07035aa0a2
SHA512 7c6950c8e0d6e38097d937855742ad92b27eb06fa6046e2bdb2da0fb002267e16e17efe93402807da7a4f43d416616efc3063e75e19988cb6a8cd81aaeeb6726
SSDEEP 3072:yXvGyjo4QoyjqdoQJwrcL3wWU8lye9vRtyU4W7gdxo:nyU4yMyCvSBW7gs
TLSH
T14B94D089FBCFF33BE51F0BB1420A70D4AA0A9D8465586DD28FF4C3591728421D6ACED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vdceeval7at.sys

Path C:\Windows\System32\vdceeval7at.sys
Size 20KB
SHA256 62af62ab3df653168385c9380873bb4f73955f496dda4960f685a2089f92fb3a
MD5 fc0a91d892c76581d6cfdd8a5d3089e4
SHA1 583f40956ecd5d404c7912b94fe324e8bddf9069
SHA512 318cb4af47e01b148db4d60c71f299cab0808d6c4f00cd34233a06f2c70938b0cb4061f39c146151eeb17184047d86e0e9cd2d35c37b1937e20b9652546a4616
SSDEEP 384:vuYh3tyXAK/HeY6QNyAmL4/y8R3CFtoLveyc:JtDm+NxLk58Keyc
TLSH
T1D8927EC78554ACD2FE57AF34F5ED8523AEB5B2811B81C1C76048C0A64AE1BC139BC7AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads