Overview

overview

6

Static

static

68804bdb6df164...35.exe

windows7_x64

6

68804bdb6df164...35.exe

windows10-2004_x64

6
General
Target

68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe

Filesize

2MB

Completed

20-05-2022 18:09

Task

behavioral2

Score
6/10
MD5

8144d5ef8ee5d12dcec2fa794e818ce3

SHA1

290d28b216bdad2a242a0a57c0a83e0a96b0777b

SHA256

68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35

SHA256

d8f600411b4776dd217c3d841d5db25fda76a5d02c60a7fb62f769a3cf8cbfe82aaf58041159cbb7ff4ffaf0833972aaafd9a0c9c563a976d49207202f73f6f0

Malware Config
Signatures 3

Filter: none

Defense Evasion
Persistence
  • Writes to the Master Boot Record (MBR)
    68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe

    Description

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    Tags

    TTPs

    Bootkit

    Reported IOCs

    descriptioniocprocess
    File opened for modification\??\PhysicalDrive068804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
  • Modifies Internet Explorer settings
    68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe

    Tags

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "0"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "0"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "0"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_STATUS_BAR_THROTTLING\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "1"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "1"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ADDON_MANAGEMENT\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "0"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "1"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "1"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IVIEWOBJECTDRAW_DMLT9_WITH_GDI68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "1"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SCRIPTURL_MITIGATION\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "1"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "1"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_VALIDATE_NAVIGATE_URL68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WINDOW_RESTRICTIONS\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "0"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "11000"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SPELLCHECKING68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "0"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_POPUPMANAGEMENT\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe = "0"68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    Key created\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBSOCKET68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
  • Suspicious behavior: EnumeratesProcesses
    68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe

    Reported IOCs

    pidprocess
    267268804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    267268804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    267268804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    267268804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe
    "C:\Users\Admin\AppData\Local\Temp\68804bdb6df164b48be0caa5e41ca03170306ff5d50df878829de87f7d97cd35.exe"
    Writes to the Master Boot Record (MBR)
    Modifies Internet Explorer settings
    Suspicious behavior: EnumeratesProcesses
    PID:2672
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads