cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde

General

Target

cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Size

815KB
MD5

de918532911821bda5aab1717774daa1
SHA1

1332afd8ff680f5297fc3981f1c65d605979dcb0
SHA256

cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde
SHA512

5c995f46184668ca7515a69a07212095bcdd88f44f94c22743966498b3bed4487648bcdae0d7d259edf55823a962e0977f027da3340a1aff710c0872e9f49e9e

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe

description ioc process

File opened for modification \??\PhysicalDrive0 cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

Processes:

cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\7654.com\NumberOfSubdomains = "1"	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\news.7654.com	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\news.7654.com\ = "63"	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe = "11000"	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\7654.com	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Key created	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "63"	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\DOMStorage\7654.com\Total = "63"	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe

pid	process
860	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
860	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe

pid process

860 cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe

pid	process
860	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
860	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
860	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
860	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
860	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
860	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
860	cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe

C:\Users\Admin\AppData\Local\Temp\cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe
"C:\Users\Admin\AppData\Local\Temp\cf30bb977a3397d79ac55f800b760dd02020fdbcd35835a5ba77baae7ba8cfde.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-54-0x0000000076191000-0x0000000076193000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads