60d94692d731fce2eef39ae2814807a0042eae1fe5a82f43c44f5ab69718604b

Analysis

max time kernel
90s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Baidu_Com_90000215.exe
Size

1.4MB
MD5

20dbd1541448c659e921ca523da62e8b
SHA1

59dfc6db7e026c5a27e89983d55be83aadf3a909
SHA256

0215531b7de01049eb626ab9c35f5e1264263bd11b120964a6ee34193e60561a
SHA512

ae4392893614f76bd2588cd9efa46dc6a5e14e3f2d23cf6da2d158f9bc70201a074558e8d103640c78a58d5dac5a84b1096e0a459c7917d6f8f5bb2adf71ff0b
SSDEEP

24576:aCfFgOHDg89bvfpETrWTVvqPldRv4dyB41Zk1J03xm4U5r1mqF+R3qo06QvuEjGn:RqOFbnaTrTTA041ZAKxFW8qFMan6Kudn

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
864	Baidu_Com_90000215.exe
864	Baidu_Com_90000215.exe
864	Baidu_Com_90000215.exe
864	Baidu_Com_90000215.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Baidu_Com_90000215.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid	Baidu_Com_90000215.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd	Baidu_Com_90000215.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid\SequenceID = 501a4cd94f408742a36548d91c78e02a	Baidu_Com_90000215.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
864	Baidu_Com_90000215.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
864	Baidu_Com_90000215.exe

C:\Users\Admin\AppData\Local\Temp\Baidu_Com_90000215.exe
"C:\Users\Admin\AppData\Local\Temp\Baidu_Com_90000215.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nstACD.tmp\BDMDownload.dll

Filesize
158KB

MD5
d184763cb4e62d531193978de7b82db2

SHA1
f4824e6e58f50b1fd89396afa17d0f97d86895f7

SHA256
63a233664064e22fd3260e4dc06293b8fa724e62071ad1cf8af9a4bb453e1dea

SHA512
25bb657827c1c4ce410346e11e60fe954f62100731bd730405cba666d4eb7009dfd394053e2afabfd9981ea0eea5fa625f24805a1d4d24c7da44f6449eda7e1b

Download Submit
\Users\Admin\AppData\Local\Temp\nstACD.tmp\BDMSkin.dll

Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
\Users\Admin\AppData\Local\Temp\nstACD.tmp\dl.dll

Filesize
1.9MB

MD5
763b532d651f0ad5e135d9b57bf4fba4

SHA1
23f1302f904a67a1fe0d48e11a435c2f36336196

SHA256
50b3c45ede6fd2d77c4f040242b2174289767b18a3a084e7046133b05f93e173

SHA512
a4ec0f5bfa30d3558935f4075a75aebf080ece324a550c573d8a424730693b030cd26b4862973e8da8937e610c287d64e96c2fd952b59324ed1822919a00737c

Download Submit
\Users\Admin\AppData\Local\Temp\nstACD.tmp\tmpe_nxps.dll

Filesize
636KB

MD5
f0797dbe1af08f015da9b298d933bd43

SHA1
653a424c60cc4795a75f2f661f869c4a60678976

SHA256
3f3bfbfe70a4381d4e7f410163802a50ab21da0c01855944d52e07500bc519ce

SHA512
de9a8ba4218a4155eb2cd6c37f857e41402caf2d439ae88d50e73bf6088c9d0151070f265462042d98caf1c4990093518e3d3a2d23f918340d70699118af3a99

Download Submit
memory/864-54-0x0000000075141000-0x0000000075143000-memory.dmp

Filesize
8KB

Download
memory/864-63-0x0000000004BE0000-0x0000000004DCD000-memory.dmp

Filesize
1.9MB

Download