73ab133e1c747687536f0a86a86b2a407ac7917f6f0a5ead4dd40f1c1ecd7dcf

Analysis

max time kernel
65s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73ab133e1c747687536f0a86a86b2a407ac7917f6f0a5ead4dd40f1c1ecd7dcf.exe
Size

121KB
MD5

70cc6e12120a7b848b777559d5d19302
SHA1

64733154c93b3236ad98e16c79d0a1f9a5b50eff
SHA256

73ab133e1c747687536f0a86a86b2a407ac7917f6f0a5ead4dd40f1c1ecd7dcf
SHA512

48a03cb70efbba58cb707e71ed4948dfd37fb8a84da7809d977656a307981171046013ccec4b69571cc3eefe60d0884cf4c3d6024306b2907dbe8cf1ca80191e
SSDEEP

3072:T+ao3nUW4kV3zcOgl9Epy4bxKsWIGM0W1Iny3lntpl0NuTD1:Ro/jc1LEbwLIGNW1In6lntpWN4

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\physicaldrive0	73ab133e1c747687536f0a86a86b2a407ac7917f6f0a5ead4dd40f1c1ecd7dcf.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
112	73ab133e1c747687536f0a86a86b2a407ac7917f6f0a5ead4dd40f1c1ecd7dcf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	112	73ab133e1c747687536f0a86a86b2a407ac7917f6f0a5ead4dd40f1c1ecd7dcf.exe

C:\Users\Admin\AppData\Local\Temp\73ab133e1c747687536f0a86a86b2a407ac7917f6f0a5ead4dd40f1c1ecd7dcf.exe
"C:\Users\Admin\AppData\Local\Temp\73ab133e1c747687536f0a86a86b2a407ac7917f6f0a5ead4dd40f1c1ecd7dcf.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-54-0x0000000074C11000-0x0000000074C13000-memory.dmp

Filesize
8KB

Download
memory/112-55-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/112-56-0x0000000000430000-0x0000000000530000-memory.dmp

Filesize
1024KB

Download