af61eb5badf2e9c1276c7186b256f6f055bb31d1992c09ff2c58c163683de3dd

Analysis

max time kernel
46s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 23:28

Target

af61eb5badf2e9c1276c7186b256f6f055bb31d1992c09ff2c58c163683de3dd.dll
Size

120KB
MD5

a3146743c6addac006abcaa629598016
SHA1

8cdb96cba7fde1ab7012950e901644aecd5d5158
SHA256

af61eb5badf2e9c1276c7186b256f6f055bb31d1992c09ff2c58c163683de3dd
SHA512

ba36df01522949f74375c3ba3cfdf03e64cad87c219d3acadf88710f9e4a351f98638399ce58f914d94b0ac999777396576b8c3a58d8931d38dc94ebfd2563cc
SSDEEP

3072:6aPP0CdUf+5VLgYLxjQbyagkMbCvwur1S:H5VbFrabO5ug

Score

6^/10

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

Bootkit

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1972	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27
PID 1880 wrote to memory of 1972	1880	rundll32.exe	27

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\af61eb5badf2e9c1276c7186b256f6f055bb31d1992c09ff2c58c163683de3dd.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\af61eb5badf2e9c1276c7186b256f6f055bb31d1992c09ff2c58c163683de3dd.dll,#1
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  PID:1972

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1972-55-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1972-56-0x00000000000B0000-0x00000000000BB000-memory.dmp

Filesize
44KB

Download
memory/1972-58-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/1972-60-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/1972-61-0x00000000000B0000-0x00000000000BB000-memory.dmp

Filesize
44KB

Download
memory/1972-62-0x00000000000B0000-0x00000000000BB000-memory.dmp

Filesize
44KB

Download