9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee

Analysis

max time kernel
42s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 00:26

Target

9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe
Size

421KB
MD5

e96966866ed30da34faff4f00fd681cc
SHA1

cad8cdab79fed6e9c5144697df5f95679aebbefa
SHA256

9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee
SHA512

e5989c65510a2dfe3bffc4ebaac0433312da74e672863902ba3eea51d7143440e215ceb399af484fe30fa0b7778743223ea276a9216b87cfd5f2295643b09807
SSDEEP

12288:ZUmh+dU/DBdd1cO5dqpEddplIZVzYKj86sN6A:ZLhkUbBdzcOQEddplspYOjA

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

Bootkit

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1572 set thread context of 1920	1572	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	27

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1920	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe
1920	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1920	1572	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	27
PID 1572 wrote to memory of 1920	1572	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	27
PID 1572 wrote to memory of 1920	1572	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	27
PID 1572 wrote to memory of 1920	1572	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	27
PID 1572 wrote to memory of 1920	1572	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	27
PID 1572 wrote to memory of 1920	1572	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	27
PID 1572 wrote to memory of 1920	1572	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	27
PID 1572 wrote to memory of 1920	1572	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	27
PID 1920 wrote to memory of 1420	1920	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	15
PID 1920 wrote to memory of 1420	1920	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	15
PID 1920 wrote to memory of 1420	1920	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	15
PID 1920 wrote to memory of 1420	1920	9e62cd0e66bce54fe29156b3ff0fea78a734baec03150cf697f135384e4e75ee.exe	15

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1420-68-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1572-54-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/1572-55-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/1572-65-0x0000000000400000-0x00000000004E3000-memory.dmp

Filesize
908KB

Download
memory/1920-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1920-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1920-59-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1920-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1920-66-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/1920-67-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1920-71-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download