ac50a2f233bed117ea4aab2ec0437e1d04661664f24f1a59cfd29c9fad16f77a

Analysis

max time kernel
177s
max time network
257s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 21:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mxdbl.pc6.0831/冒险伴侣0831/Baidu_Com_90000168.exe
Size

1.4MB
MD5

d49e4198096aa6f7af3787ba230198c2
SHA1

e7a3c4feb071ec294ce14d74f6e0fa603740f1af
SHA256

2343e15558bba1e08369527cebd7082495c4fb5f1f859f1806f4ac0b464cd304
SHA512

a36ba06bdf98783b33d30b3f87854387493de077a679105ebb4af9e29df809e623738fab5014109e44d5965e8c07173e9f57c92fb1e02dc6b57b03095988dfa1
SSDEEP

24576:eCNjeWLiBF5Addz/++bJnksHBmNqvdOg5m8y01HHiaqulkrpsEG3eX:DjNLsFybzhkaBmNWdN5HyLHekeEG3+

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 4 IoCs

Processes:

Baidu_Com_90000168.exe

pid process

576 Baidu_Com_90000168.exe
576 Baidu_Com_90000168.exe
576 Baidu_Com_90000168.exe
576 Baidu_Com_90000168.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

Baidu_Com_90000168.exe

description ioc process

File opened for modification \??\PhysicalDrive0 Baidu_Com_90000168.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
576	Baidu_Com_90000168.exe
576	Baidu_Com_90000168.exe
576	Baidu_Com_90000168.exe
576	Baidu_Com_90000168.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Baidu_Com_90000168.exe

Modifies registry class 3 IoCs

Processes:

Baidu_Com_90000168.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid	Baidu_Com_90000168.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd	Baidu_Com_90000168.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid\SequenceID = 314aae339315d24e8636c7cae810ec1f	Baidu_Com_90000168.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

Baidu_Com_90000168.exe

pid process

576 Baidu_Com_90000168.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

Baidu_Com_90000168.exe

pid process

576 Baidu_Com_90000168.exe

pid	process
576	Baidu_Com_90000168.exe

pid	process
576	Baidu_Com_90000168.exe

C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\Baidu_Com_90000168.exe
"C:\Users\Admin\AppData\Local\Temp\mxdbl.pc6.0831\冒险伴侣0831\Baidu_Com_90000168.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:576

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nszA46D.tmp\BDMDownload.dll
Filesize
158KB

MD5
d184763cb4e62d531193978de7b82db2

SHA1
f4824e6e58f50b1fd89396afa17d0f97d86895f7

SHA256
63a233664064e22fd3260e4dc06293b8fa724e62071ad1cf8af9a4bb453e1dea

SHA512
25bb657827c1c4ce410346e11e60fe954f62100731bd730405cba666d4eb7009dfd394053e2afabfd9981ea0eea5fa625f24805a1d4d24c7da44f6449eda7e1b

Download Submit
\Users\Admin\AppData\Local\Temp\nszA46D.tmp\BDMSkin.dll
Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
\Users\Admin\AppData\Local\Temp\nszA46D.tmp\dl.dll
Filesize
1.9MB

MD5
763b532d651f0ad5e135d9b57bf4fba4

SHA1
23f1302f904a67a1fe0d48e11a435c2f36336196

SHA256
50b3c45ede6fd2d77c4f040242b2174289767b18a3a084e7046133b05f93e173

SHA512
a4ec0f5bfa30d3558935f4075a75aebf080ece324a550c573d8a424730693b030cd26b4862973e8da8937e610c287d64e96c2fd952b59324ed1822919a00737c

Download Submit
\Users\Admin\AppData\Local\Temp\nszA46D.tmp\tmpxblgiy.dll
Filesize
620KB

MD5
e0d8d0a69ce5eeb83594d4517afa54f6

SHA1
b34de8329a7c014d3cf3f5fe6d9d8e679d4918fd

SHA256
ba9e1a46344846aa2138c970f6581fd364bc9369fdbb9402199589fe0645abf0

SHA512
ab7c752abb37165edff8e389f8ee0ac48149c9092decf347989df4ab47e5dd5046c131a74b1e35e15c31f6f95cc69ebd05c8d41162788a151f78e2d9025ca4a7

Download Submit
memory/576-54-0x0000000075F01000-0x0000000075F03000-memory.dmp

Filesize
8KB

Download
memory/576-63-0x0000000004C50000-0x0000000004E3D000-memory.dmp

Filesize
1.9MB

Download