78bda078e72a7c5652769265a2b2a589d15e0e48e18c0a56d983127772683d39

Analysis

max time kernel
37s
max time network
43s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02-12-2022 23:28

Target

78bda078e72a7c5652769265a2b2a589d15e0e48e18c0a56d983127772683d39.dll
Size

76KB
MD5

fd44e48892f2da8457acab30caa82ced
SHA1

74f26519ac61810348de2af5b4c87d2fb8628dfb
SHA256

78bda078e72a7c5652769265a2b2a589d15e0e48e18c0a56d983127772683d39
SHA512

e0c80a1e54c2f5bf502dab4f6308a70f5f9f44baf18b98d8bbb161bc9a0dcbaab653ccf5c760923844a9082cd106287c92c21052ef51dddbbaacd088fb42594e
SSDEEP

768:ci7HqS2PdK/6eyQKLncMCIdbuHmNGdRK4wxQiVstyTpLZdShAMz++ODfkDgHrAbM:ciOYvHQcOdbuHmNt4g/dSqMz+fDqB2

Score

6^/10

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

Bootkit

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1460	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26
PID 1504 wrote to memory of 1460	1504	rundll32.exe	26

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\78bda078e72a7c5652769265a2b2a589d15e0e48e18c0a56d983127772683d39.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\78bda078e72a7c5652769265a2b2a589d15e0e48e18c0a56d983127772683d39.dll,#1
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  PID:1460

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1460-54-0x0000000000000000-mapping.dmp

Download
memory/1460-55-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1460-56-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download
memory/1460-58-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/1460-60-0x00000000001A0000-0x00000000001AA000-memory.dmp

Filesize
40KB

Download