a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c

Analysis

max time kernel
115s
max time network
197s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 09:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c.exe
Size

2.1MB
MD5

92fd731af46d552f67e4dead0e371ffd
SHA1

116561ddb770e8c9fae587ffb3ae68610a1d72a5
SHA256

a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c
SHA512

81ce767d7e574888c8227ed99c691f18607c59f0d8420e70a0e757fe190ff3de4143f2beaff0178bd83aaace2f39a36573090b3241a558c9a167782612e451f3
SSDEEP

24576:hSjhOMesDwF5Hm2hA6+tpopN/1O2d2CtTmE5pzvGalH4ymUWvrI:hKh/9IG2h0taHO2pp6

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c.exe

description ioc process

File opened for modification \??\PhysicalDrive0 a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c.exe

pid	process
752	a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c.exe
752	a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c.exe
752	a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c.exe

C:\Users\Admin\AppData\Local\Temp\a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c.exe
"C:\Users\Admin\AppData\Local\Temp\a4f1c692e2a34a48eba903d6a46a7aae0a9766a091703341fa63e230e738243c.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:752

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-54-0x0000000000400000-0x0000000000947000-memory.dmp

Filesize
5.3MB

Download
memory/752-57-0x0000000000C60000-0x0000000000CBA000-memory.dmp

Filesize
360KB

Download
memory/752-58-0x0000000003990000-0x0000000003E60000-memory.dmp

Filesize
4.8MB

Download
memory/752-59-0x0000000000400000-0x0000000000947000-memory.dmp

Filesize
5.3MB

Download
memory/752-60-0x0000000000C60000-0x0000000000CBA000-memory.dmp

Filesize
360KB

Download
memory/752-61-0x0000000003990000-0x0000000003E60000-memory.dmp

Filesize
4.8MB

Download
memory/752-62-0x0000000006371000-0x000000000721D000-memory.dmp

Filesize
14.7MB

Download