14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3

Analysis

max time kernel
15s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe
Size

3.2MB
MD5

8c2642a39f999d3cbfd7e02fb9166487
SHA1

1a74eb6b322b511fb68c9b1aba708c97257f85a3
SHA256

14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3
SHA512

349e590b8d426965a6b82a29c8444fa49d9aecc883862978a06fc374909e79c420a737afcc64058ab9083da9321ac4ee30569a4d21b6da74f8301ebaf9971054
SSDEEP

49152:H8dC6OzO+r82X2ydervueejFl+5Gr006g5iNviIXL1BoCQycl+mZBHc1/9zZpw8+:Ae5DX2yEm5mQ0SMaIXLLNeDB81RZy

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe

description ioc process

File opened for modification \??\PhysicalDrive0 14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe

Modifies registry class 3 IoCs

Processes:

14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe

pid process

1628 14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe

pid	process
1628	14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe

C:\Users\Admin\AppData\Local\Temp\14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe
"C:\Users\Admin\AppData\Local\Temp\14e9ec85599f6d13b0a94d3459fc6109e7e344a8feb94c5161f39a155f0e3dd3.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1628

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1628-55-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download
memory/1628-56-0x0000000002E30000-0x0000000002F70000-memory.dmp

Filesize
1.2MB

Download
memory/1628-58-0x0000000002E30000-0x0000000002F70000-memory.dmp

Filesize
1.2MB

Download
memory/1628-59-0x0000000002E30000-0x0000000002F70000-memory.dmp

Filesize
1.2MB

Download
memory/1628-57-0x0000000002E30000-0x0000000002F70000-memory.dmp

Filesize
1.2MB

Download
memory/1628-60-0x0000000002E30000-0x0000000002F70000-memory.dmp

Filesize
1.2MB

Download
memory/1628-61-0x0000000002E30000-0x0000000002F70000-memory.dmp

Filesize
1.2MB

Download
memory/1628-64-0x0000000002E30000-0x0000000002F70000-memory.dmp

Filesize
1.2MB

Download
memory/1628-63-0x0000000002E30000-0x0000000002F70000-memory.dmp

Filesize
1.2MB

Download
memory/1628-62-0x0000000002E30000-0x0000000002F70000-memory.dmp

Filesize
1.2MB

Download
memory/1628-66-0x0000000002E30000-0x0000000002F70000-memory.dmp

Filesize
1.2MB

Download
memory/1628-67-0x0000000002940000-0x0000000002944000-memory.dmp

Filesize
16KB

Download
memory/1628-68-0x0000000000400000-0x0000000000E13000-memory.dmp

Filesize
10.1MB

Download