0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f

Analysis

max time kernel
135s
max time network
138s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe
Size

468KB
MD5

8272ecc7bce64a3b305d0960a36ba840
SHA1

e9d61e2a2c95c2e2e6489fccc70ac3bb33bec34f
SHA256

0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f
SHA512

29ea5fdb3d1050066b5a13b1fad3d94a1c6506731a6ce2a1e3af11f16b4c1eeafe8b2f1a9e50625e31402f94a67b1a2fb872a6552898dade16d75fb79966bc16
SSDEEP

12288:bb7jkD3v0VBRxE5MBGlcM7UdTMl7UZWG1j3FLiUhf:bb3w3v8BRqEM7Ud0U1j35iI

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1104	GHFHGJHNSSJDW.exe

Deletes itself 1 IoCs

pid	Process
2000	cmd.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe
File opened for modification	\??\PhysicalDrive0	GHFHGJHNSSJDW.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GHFHGJHNSSJDW.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\GHFHGJHNSSJDW.exe	0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe
File opened for modification	C:\Windows\GHFHGJHNSSJDW.exe	0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe
File created	C:\Windows\HKFX2008.BAT	0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44705F7C-6AA8-4ED6-A2F5-774BD2740C95}\WpadDecision = "0"	GHFHGJHNSSJDW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	GHFHGJHNSSJDW.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0091000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	GHFHGJHNSSJDW.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GHFHGJHNSSJDW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	GHFHGJHNSSJDW.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	GHFHGJHNSSJDW.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	GHFHGJHNSSJDW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	GHFHGJHNSSJDW.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44705F7C-6AA8-4ED6-A2F5-774BD2740C95}	GHFHGJHNSSJDW.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dd-0f-5e-73-0c	GHFHGJHNSSJDW.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dd-0f-5e-73-0c\WpadDecisionTime = a04047212bedd801	GHFHGJHNSSJDW.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44705F7C-6AA8-4ED6-A2F5-774BD2740C95}\WpadDecisionTime = 00bd0f5e2bedd801	GHFHGJHNSSJDW.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	GHFHGJHNSSJDW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	GHFHGJHNSSJDW.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44705F7C-6AA8-4ED6-A2F5-774BD2740C95}\WpadDecisionTime = a04047212bedd801	GHFHGJHNSSJDW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dd-0f-5e-73-0c\WpadDecisionReason = "1"	GHFHGJHNSSJDW.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dd-0f-5e-73-0c\WpadDetectedUrl	GHFHGJHNSSJDW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dd-0f-5e-73-0c\WpadDecision = "0"	GHFHGJHNSSJDW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	GHFHGJHNSSJDW.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44705F7C-6AA8-4ED6-A2F5-774BD2740C95}\WpadNetworkName = "Network 3"	GHFHGJHNSSJDW.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	GHFHGJHNSSJDW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	GHFHGJHNSSJDW.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-dd-0f-5e-73-0c\WpadDecisionTime = 00bd0f5e2bedd801	GHFHGJHNSSJDW.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0091000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	GHFHGJHNSSJDW.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44705F7C-6AA8-4ED6-A2F5-774BD2740C95}\WpadDecisionReason = "1"	GHFHGJHNSSJDW.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{44705F7C-6AA8-4ED6-A2F5-774BD2740C95}\d6-dd-0f-5e-73-0c	GHFHGJHNSSJDW.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	GHFHGJHNSSJDW.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	GHFHGJHNSSJDW.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1208	0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe
Token: SeDebugPrivilege	1104	GHFHGJHNSSJDW.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1104	GHFHGJHNSSJDW.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 820	1104	GHFHGJHNSSJDW.exe	28
PID 1104 wrote to memory of 820	1104	GHFHGJHNSSJDW.exe	28
PID 1104 wrote to memory of 820	1104	GHFHGJHNSSJDW.exe	28
PID 1104 wrote to memory of 820	1104	GHFHGJHNSSJDW.exe	28
PID 1208 wrote to memory of 2000	1208	0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe	29
PID 1208 wrote to memory of 2000	1208	0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe	29
PID 1208 wrote to memory of 2000	1208	0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe	29
PID 1208 wrote to memory of 2000	1208	0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe	29

C:\Users\Admin\AppData\Local\Temp\0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe
"C:\Users\Admin\AppData\Local\Temp\0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\HKFX2008.BAT
  2⤵
  - Deletes itself
  PID:2000

C:\Windows\GHFHGJHNSSJDW.exe
C:\Windows\GHFHGJHNSSJDW.exe
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\GHFHGJHNSSJDW.exe

Filesize
468KB

MD5
8272ecc7bce64a3b305d0960a36ba840

SHA1
e9d61e2a2c95c2e2e6489fccc70ac3bb33bec34f

SHA256
0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f

SHA512
29ea5fdb3d1050066b5a13b1fad3d94a1c6506731a6ce2a1e3af11f16b4c1eeafe8b2f1a9e50625e31402f94a67b1a2fb872a6552898dade16d75fb79966bc16

Download Submit
C:\Windows\GHFHGJHNSSJDW.exe

Filesize
468KB

MD5
8272ecc7bce64a3b305d0960a36ba840

SHA1
e9d61e2a2c95c2e2e6489fccc70ac3bb33bec34f

SHA256
0ca2bc950e41335dac0418f89d05f133934822f60b9d5353405b70f2c718427f

SHA512
29ea5fdb3d1050066b5a13b1fad3d94a1c6506731a6ce2a1e3af11f16b4c1eeafe8b2f1a9e50625e31402f94a67b1a2fb872a6552898dade16d75fb79966bc16

Download Submit
C:\Windows\HKFX2008.BAT

Filesize
254B

MD5
1a811e2564e3dfae584ee04a9795faae

SHA1
d083a51116943f7fdc14d3347ff7c908ac9a55a2

SHA256
d9f9109de05ae6aab7d57e272123a08f5f0e895c4628138b80f37d44068ffe47

SHA512
dcb9e87b9080f4961f740ecbff0ffdcbfdc06e3649b20d609a2345e4faf1c088aecf9ca00a3d8dc43c48d688adc1a5ffa4d1bad3eaa1f4b1d249bb7ac655b630

Download Submit
memory/1104-60-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1104-61-0x00000000002D0000-0x000000000030A000-memory.dmp

Filesize
232KB

Download
memory/1104-64-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1208-54-0x0000000075D01000-0x0000000075D03000-memory.dmp

Filesize
8KB

Download
memory/1208-55-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/1208-56-0x0000000000290000-0x00000000002CA000-memory.dmp

Filesize
232KB

Download