Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
-
submitted
03/12/2022, 03:01
General
-
Target
dd1a4e387cad662a84a26fa28299757dd3efa5a9ae6e874af85865f39fa29b2e.exe
-
Size
199KB
-
MD5
27861df261adbe9fb6d6ba7a1cf7ad20
-
SHA1
4abaea17cacda41c3395dd41127d98e1a67bba9d
-
SHA256
dd1a4e387cad662a84a26fa28299757dd3efa5a9ae6e874af85865f39fa29b2e
-
SHA512
ab42c109cd826e16d09079636f9a21feca7df6f7ed277b6ce8b02778590467ad1075a93ca844ac93602e304d20e4f3e48845e9af54ac8d469ab08cf4bc0ab42f
-
SSDEEP
3072:Q+467w4PQtbJltZrpRbyXgbLo9R/nR9QYfB6tyNDIOCOazP/kMqqb4P9X3x:ljgthpWsLQD9QyB6tyNDIOOr/kMqqM1R
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd1a4e387cad662a84a26fa28299757dd3efa5a9ae6e874af85865f39fa29b2e.exe"C:\Users\Admin\AppData\Local\Temp\dd1a4e387cad662a84a26fa28299757dd3efa5a9ae6e874af85865f39fa29b2e.exe"1⤵
- Drops file in Drivers directory
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD5d043af947dc6721126ee95dd9167306b
SHA1048106a00ab723b43bf6e998066fde576451462f
SHA256d2b16145de6aee09b6cd1bb865b9937770168e9869781431169c686cd2a6cda5
SHA512f565c0b4fcb66a934eaf00674e44ed9a7a982ce42734c2ffcbe36e3a9cbf2db1c2e4eed0f9e2e9980888cefb8f8443fce133b7b212dad09a2c166b99498b4357
-
Filesize
133KB
MD5d043af947dc6721126ee95dd9167306b
SHA1048106a00ab723b43bf6e998066fde576451462f
SHA256d2b16145de6aee09b6cd1bb865b9937770168e9869781431169c686cd2a6cda5
SHA512f565c0b4fcb66a934eaf00674e44ed9a7a982ce42734c2ffcbe36e3a9cbf2db1c2e4eed0f9e2e9980888cefb8f8443fce133b7b212dad09a2c166b99498b4357
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
152KB
-
Filesize
8KB