7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
24-11-2022 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe
Size

774KB
MD5

2f79967dd4ddd5bf20b3bfc556c4aa5b
SHA1

0c0ee4306ec0e0d118cd4d0d308557667a8e6b9f
SHA256

7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c
SHA512

edd68670c2b5b5d0298d941bba25b88af3e73a6995a78343bc3079f352a0974b457c875f622ab7b879d7d6b619f1d46ae9eb2ffb2f9aee05ccd26d9590145a7e
SSDEEP

24576:msz9V9F68yELqXKXkXhsYp8UC/t6o9JwHSEcgNNmV:Fz9Vm8ZaK2h3pSlJwHSj5V

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

pid	process
532	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe
532	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe
532	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

Drops file in Program Files directory 2 IoCs

Processes:

7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

description	ioc	process
File created	C:\Program Files (x86)\ÓêÇçÌìÆø\uninst.exe	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe
File created	C:\Program Files (x86)\ÓêÇçÌìÆø\Net.dll	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
\Program Files (x86)\ÓêÇçÌìÆø\uninst.exe	nsis_installer_1
\Program Files (x86)\ÓêÇçÌìÆø\uninst.exe	nsis_installer_2

C:\Users\Admin\AppData\Local\Temp\7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe
"C:\Users\Admin\AppData\Local\Temp\7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
PID:532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\ÓêÇçÌìÆø\Net.dll

Filesize
224KB

MD5
f45fcb458cbcf3eb55009dffe559ddf8

SHA1
7ad016526ba964b573242d6e72daa70ff96413df

SHA256
6d679474aa0ea14cbb4acc8a53e610e873321df415a510d0ce497b1a850ea323

SHA512
8c0ebe1a9ced8397f991b1550320c536cb68974881895aaad4107301d702ef5d7b08ae470aab0c84126e09cb473f39bcc3c44db812cd3aaf35ba945d3248e755

Download Submit
\Program Files (x86)\ÓêÇçÌìÆø\uninst.exe

Filesize
48KB

MD5
5c0bf79084308cb9aa49aeb16306ce3d

SHA1
e0e83be64db4d96bd1a7c624e5557aa2c31c997b

SHA256
084f822109e7f166a676dace92b56601b6a2ba559f8c27775a25ddecd40f0c23

SHA512
bc5217ad14c8cc1f439213b1b520dc01c9e35cb73d5da55810d709097c759431ebb93c81fa79a53d188050f4ba94c0cb84c4081ec4ebfd466e510bdd53cc7499

Download Submit
\Users\Admin\AppData\Local\Temp\nsiF6D.tmp\System.dll

Filesize
10KB

MD5
0ae9c427fe7bbbbf1368c1c6d3933ae7

SHA1
c8e5131613302531c88512dada29a18886259268

SHA256
49437f4b9fd38007f3b2735f0a8a12830b995305c75118b440202980183d5c6a

SHA512
59b76b00f2b0d6242dc5bc3cb36d3ff78867445f502e34cea890c6f493c2adf9b97cec539963204ddd1c641e1a77139f46fc33dec4dc636f4b06d2edffffec6d

Download Submit
memory/532-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download