edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955

Analysis

max time kernel
81s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
17/10/2022, 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe
Size

1.7MB
MD5

116845a0bc1d542a6f69c75f015241c8
SHA1

848c4432871c19aaa4f02fde0f38b79b04f64da2
SHA256

edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955
SHA512

0c19baf380e2ce45df3d3b80c6509e23db7987949b60ec1900dc6e6b99ee936936fdc63864e52921bd2305d3e3b844cf0c3c7c2dae2287ce804f42e47921cd9d
SSDEEP

49152:35rk8qq0lcyVlgoRdLbD5Zs9RulvabBsZVbYRKw:3aqroRdLxlibBsZ2RT

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
780	edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe
780	edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe
780	edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe
780	edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid	edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd	edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid\SequenceID = 7a19784e987e704aaf99047e72ebccbf	edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
780	edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
780	edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe

C:\Users\Admin\AppData\Local\Temp\edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe
"C:\Users\Admin\AppData\Local\Temp\edc192d7f9863167968350c73b78bdf1eb2ebced2d5a77230121c6e1d99b1955.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:780

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsiE736.tmp\BDMDownload.dll

Filesize
158KB

MD5
4606559a1460c34734213ef37dc55395

SHA1
df0b810214ce1730d6f66795bc001da25e82c834

SHA256
0fae7c9f758e7dfe039fd31e6df7dfb1feedf4238663fae44e9cb5666d7f98dc

SHA512
a03288331193eef45bd86ef62e2e6f00ea6bb55070d939b0efc917db9190e8fc597357ac37636733070d3b64bbbff849a64f44323e44781a1192a5b589623c2c

Download Submit
\Users\Admin\AppData\Local\Temp\nsiE736.tmp\BDMSkin.dll

Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
\Users\Admin\AppData\Local\Temp\nsiE736.tmp\dl.dll

Filesize
1.9MB

MD5
763b532d651f0ad5e135d9b57bf4fba4

SHA1
23f1302f904a67a1fe0d48e11a435c2f36336196

SHA256
50b3c45ede6fd2d77c4f040242b2174289767b18a3a084e7046133b05f93e173

SHA512
a4ec0f5bfa30d3558935f4075a75aebf080ece324a550c573d8a424730693b030cd26b4862973e8da8937e610c287d64e96c2fd952b59324ed1822919a00737c

Download Submit
\Users\Admin\AppData\Local\Temp\nsiE736.tmp\tmpdhv5xe.dll

Filesize
2.5MB

MD5
2f18f1a6ba6697055490f30b217cde76

SHA1
d9bfcbeb071cfa067a3a9bb8dc32fa32b4f9954b

SHA256
59b13be9b563fabbe3ec1f8d756f3b16f384b9ae3cf2e89d7dbc813461c75645

SHA512
95cfe56d60ba573667bf41111da2ab2a95c1daca3fbcdf175e0b3cf80f8f33b097ff64473e4c1a2504cfab475bf0dbff1f33675e86fcf114463fa4edd10ff362

Download Submit
memory/780-54-0x0000000076321000-0x0000000076323000-memory.dmp

Filesize
8KB

Download
memory/780-60-0x00000000008E0000-0x0000000000908000-memory.dmp

Filesize
160KB

Download
memory/780-63-0x0000000004C90000-0x0000000004E7D000-memory.dmp

Filesize
1.9MB

Download