e8ee5244bf6b50bf6a23df50292578d385ed41f12465e80fc4535b0f50a128fd

Analysis

max time kernel
41s
max time network
47s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8ee5244bf6b50bf6a23df50292578d385ed41f12465e80fc4535b0f50a128fd.exe
Size

436KB
MD5

521ad6ea825919d5e5b540d003bfabc0
SHA1

c2c2e73783fb26204f0b83df4df898e93c82be66
SHA256

e8ee5244bf6b50bf6a23df50292578d385ed41f12465e80fc4535b0f50a128fd
SHA512

3a93d4cb108f7a7d1a05005179bdb1fc32435da2097f44456de6bf41fa2181109c05d3552bcac06d8dfada0c93401211f2191d9695cfb0032b29136935578e6f
SSDEEP

6144:1zcRya5lKa4t263zsIPMNe1uYTG12L+ZFV30i13H2dxJOR8ghuinEYCp94JLdjf:1wRya5d4Y6392KbO2Wsi1GvJWhVnLT

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
1272	e8ee5244bf6b50bf6a23df50292578d385ed41f12465e80fc4535b0f50a128fd.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	e8ee5244bf6b50bf6a23df50292578d385ed41f12465e80fc4535b0f50a128fd.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	e8ee5244bf6b50bf6a23df50292578d385ed41f12465e80fc4535b0f50a128fd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	e8ee5244bf6b50bf6a23df50292578d385ed41f12465e80fc4535b0f50a128fd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	e8ee5244bf6b50bf6a23df50292578d385ed41f12465e80fc4535b0f50a128fd.exe

C:\Users\Admin\AppData\Local\Temp\e8ee5244bf6b50bf6a23df50292578d385ed41f12465e80fc4535b0f50a128fd.exe
"C:\Users\Admin\AppData\Local\Temp\e8ee5244bf6b50bf6a23df50292578d385ed41f12465e80fc4535b0f50a128fd.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:1272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\libnspr4.dll

Filesize
10KB

MD5
28a57355d9583b66e51ad978384c159e

SHA1
b8fe4ddb6187cdee0e89c02bab4a104f406d16da

SHA256
81ed76156df0de1caae6730a091f29978493881b54a2d6fbfb43c47153b6fadd

SHA512
991a288ed0f033eb8f54e567a6264a6111f795bd61a1cd600e210730d7ed39c89e735480dc6f0e4026eafad730ae8dc23ec7bc7600a14a2ac9d652638c02ee3e

Download Submit
memory/1272-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1272-57-0x0000000000400000-0x000000000050B000-memory.dmp

Filesize
1.0MB

Download
memory/1272-58-0x0000000000610000-0x000000000061D000-memory.dmp

Filesize
52KB

Download