84d80555e883aafb0f9c035b1f44e18ca3d827759183a3aae475026029973bfc

Analysis

max time kernel
15s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/12/2022, 23:28

Target

84d80555e883aafb0f9c035b1f44e18ca3d827759183a3aae475026029973bfc.dll
Size

76KB
MD5

4e79d6a89451f65e951e739d9bd8774c
SHA1

79248d7b1883335e17f8e659fe8b8d2c478426e5
SHA256

84d80555e883aafb0f9c035b1f44e18ca3d827759183a3aae475026029973bfc
SHA512

4edde5e189c013e53dc3dc26b96bfaa6f1c8d503d1a96c1361f4c17e7b628853bf0a9adcfb4357639972db1ef409a24d79457efb3d33a0070a50f4dde93ac273
SSDEEP

1536:C535RPZ9g3o62VCMJWx4fu7TuM9J3uFxgc0unpE7:CPZQ2VCMJWx45Mf3ogcdu7

Score

6^/10

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

Bootkit

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
940	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28
PID 1868 wrote to memory of 940	1868	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\84d80555e883aafb0f9c035b1f44e18ca3d827759183a3aae475026029973bfc.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\84d80555e883aafb0f9c035b1f44e18ca3d827759183a3aae475026029973bfc.dll,#1
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  PID:940

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/940-55-0x00000000757E1000-0x00000000757E3000-memory.dmp

Filesize
8KB

Download
memory/940-56-0x00000000001A0000-0x00000000001A9000-memory.dmp

Filesize
36KB

Download
memory/940-59-0x00000000001A0000-0x00000000001A9000-memory.dmp

Filesize
36KB

Download