db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Size

2.0MB
MD5

97cd0180f4256bfbc2ee167c5559194c
SHA1

9456ba45e9a9b67e93f74917bf3b0d71e6b1ada3
SHA256

db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367
SHA512

cab481dffd617b17d817ca803dbecc31c4cddefd84207be51842f9979d45c54d9d527910d1aa82aedabe2cec773227de6918e11897b1aca3251252d565ebc176
SSDEEP

49152:cENNo0ostouD2lA74frEScZcsDY8hZ9NYfpDWN3CB6q3Tj5:cwostoTY4frDYcs39NYhDQ3CBR3R

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: 33	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
Token: SeIncBasePriorityPrivilege	1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
1988	db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe

C:\Users\Admin\AppData\Local\Temp\db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe
"C:\Users\Admin\AppData\Local\Temp\db4d1390c51384d3d00735289f68913874fb4af8d5185dc3de805e249615a367.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1988

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-54-0x0000000075911000-0x0000000075913000-memory.dmp

Filesize
8KB

Download
memory/1988-55-0x0000000000400000-0x0000000000D34000-memory.dmp

Filesize
9.2MB

Download
memory/1988-57-0x0000000000400000-0x0000000000D34000-memory.dmp

Filesize
9.2MB

Download
memory/1988-58-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-62-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-64-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-66-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-70-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-68-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-74-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-72-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-84-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-82-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-80-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-78-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-76-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-86-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-94-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-92-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-102-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-100-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-98-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-96-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-90-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-88-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-103-0x0000000000D40000-0x0000000000D91000-memory.dmp

Filesize
324KB

Download
memory/1988-104-0x0000000000400000-0x0000000000D34000-memory.dmp

Filesize
9.2MB

Download