7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c

Analysis

max time kernel
100s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
24-11-2022 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe
Size

774KB
MD5

2f79967dd4ddd5bf20b3bfc556c4aa5b
SHA1

0c0ee4306ec0e0d118cd4d0d308557667a8e6b9f
SHA256

7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c
SHA512

edd68670c2b5b5d0298d941bba25b88af3e73a6995a78343bc3079f352a0974b457c875f622ab7b879d7d6b619f1d46ae9eb2ffb2f9aee05ccd26d9590145a7e
SSDEEP

24576:msz9V9F68yELqXKXkXhsYp8UC/t6o9JwHSEcgNNmV:Fz9Vm8ZaK2h3pSlJwHSj5V

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Loads dropped DLL 3 IoCs

Processes:

7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

pid	process
4612	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe
4612	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe
4612	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

Drops file in Program Files directory 2 IoCs

Processes:

7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

description	ioc	process
File created	C:\Program Files (x86)\ÓêÇçÌìÆø\Net.dll	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe
File created	C:\Program Files (x86)\ÓêÇçÌìÆø\uninst.exe	7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Users\Admin\AppData\Local\Temp\7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe
"C:\Users\Admin\AppData\Local\Temp\7aeb8d550fa7cccb17e2302e05bbd43559b460f26ddd263f985de8c94fee3b6c.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
PID:4612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\ÓêÇçÌìÆø\Net.dll

Filesize
224KB

MD5
f45fcb458cbcf3eb55009dffe559ddf8

SHA1
7ad016526ba964b573242d6e72daa70ff96413df

SHA256
6d679474aa0ea14cbb4acc8a53e610e873321df415a510d0ce497b1a850ea323

SHA512
8c0ebe1a9ced8397f991b1550320c536cb68974881895aaad4107301d702ef5d7b08ae470aab0c84126e09cb473f39bcc3c44db812cd3aaf35ba945d3248e755

Download Submit
C:\Program Files (x86)\ÓêÇçÌìÆø\Net.dll

Filesize
224KB

MD5
f45fcb458cbcf3eb55009dffe559ddf8

SHA1
7ad016526ba964b573242d6e72daa70ff96413df

SHA256
6d679474aa0ea14cbb4acc8a53e610e873321df415a510d0ce497b1a850ea323

SHA512
8c0ebe1a9ced8397f991b1550320c536cb68974881895aaad4107301d702ef5d7b08ae470aab0c84126e09cb473f39bcc3c44db812cd3aaf35ba945d3248e755

Download Submit
C:\Users\Admin\AppData\Local\Temp\nst1D1E.tmp\System.dll

Filesize
10KB

MD5
0ae9c427fe7bbbbf1368c1c6d3933ae7

SHA1
c8e5131613302531c88512dada29a18886259268

SHA256
49437f4b9fd38007f3b2735f0a8a12830b995305c75118b440202980183d5c6a

SHA512
59b76b00f2b0d6242dc5bc3cb36d3ff78867445f502e34cea890c6f493c2adf9b97cec539963204ddd1c641e1a77139f46fc33dec4dc636f4b06d2edffffec6d

Download Submit
memory/4612-135-0x00000000030A0000-0x00000000030DC000-memory.dmp

Filesize
240KB

Download