efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4

Analysis

max time kernel
0s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 11:27

Sharing

Copy URL

Twitter E-mail

Reason

Reading agent response: read tcp 10.127.0.1:45662->10.127.0.32:8000: read: connection reset by peer

Report Analysis Logs

General

Target

efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe
Size

301KB
MD5

04b1057e2795043a6a7681ac951c6506
SHA1

a174173bc54629f7a9d8972dfc0731c1e7916d3b
SHA256

efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4
SHA512

6491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f
SSDEEP

6144:eMghXT2rtzWLM4DCAgdCNh4rhJBiWSnG85jI4:e7wyEdCD4rBSnGY

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
872	x2z8.exe

Loads dropped DLL 2 IoCs

pid	Process
1016	efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe
1016	efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe
File opened for modification	\??\PHYSICALDRIVE0	x2z8.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	872	x2z8.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 872	1016	efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe	28
PID 1016 wrote to memory of 872	1016	efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe	28
PID 1016 wrote to memory of 872	1016	efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe	28
PID 1016 wrote to memory of 872	1016	efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe	28

C:\Users\Admin\AppData\Local\Temp\efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe
"C:\Users\Admin\AppData\Local\Temp\efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Temp\x2z8.exe
  C:\Users\Admin\AppData\Local\Temp\\x2z8.exe
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of AdjustPrivilegeToken
  PID:872

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fpath.txt

Filesize
102B

MD5
963a5daddeb4abebe5ac4195b71ca1bd

SHA1
cd26eebb37a32c0ce9ef24b9b0b52eb6d9f23567

SHA256
4ed801b3b77e4f53f3f6ecdff3547052987272063e0e027d90aaeca3fd44e2d0

SHA512
a3631d5cfbf0ebc59d9bdc1ca2f8b088314111a914fa23e81f9e54385a79c12b6b1e2e3bcbb08586416ac39cb06b98df22b90b6fe4f470d581ac7922b6ddaedf

Download Submit
C:\Users\Admin\AppData\Local\Temp\x2z8.exe

Filesize
301KB

MD5
04b1057e2795043a6a7681ac951c6506

SHA1
a174173bc54629f7a9d8972dfc0731c1e7916d3b

SHA256
efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4

SHA512
6491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f

Download Submit
\Users\Admin\AppData\Local\Temp\x2z8.exe

Filesize
301KB

MD5
04b1057e2795043a6a7681ac951c6506

SHA1
a174173bc54629f7a9d8972dfc0731c1e7916d3b

SHA256
efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4

SHA512
6491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f

Download Submit
\Users\Admin\AppData\Local\Temp\x2z8.exe

Filesize
301KB

MD5
04b1057e2795043a6a7681ac951c6506

SHA1
a174173bc54629f7a9d8972dfc0731c1e7916d3b

SHA256
efe12ca831e2a03ae54e76c73b0de07a1818002636df11bbda431b747541f1a4

SHA512
6491d63b64f42f2161ab17f3508f4344cbb7bb556030c4ac9301b1bbae6239581d197a7ad3377ab1949d95480f0c950e03ca14061ce5ca89a07d2cc3762ac77f

Download Submit
memory/872-62-0x0000000000330000-0x0000000000333000-memory.dmp

Filesize
12KB

Download
memory/1016-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Filesize
8KB

Download
memory/1396-61-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Filesize
8KB

Download