62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a

Analysis

max time kernel
142s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
04-12-2022 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe
Size

146KB
MD5

8ea1279367d8fddb94d76d9b5b4cf146
SHA1

91fd5069dc91052ae6cf0801f6bfaeb9f5db072d
SHA256

62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a
SHA512

cfd5d091af969fb4c21e98f08426712c3a0280d355a78b81c87d6b360fa82fbfc4832e3e25019f394342b7a57228e3c8ba828aa8c918a6b56aaede27ea65c655
SSDEEP

3072:EJU9ULrLIDjMSmoSsI4lC9mx0Mxtus4URyFkMN29AEK8hJuNpSUtq9s9x:EJbIUjoSC7GUYU8k1F4pMs

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

fkp.exe

pid process

684 fkp.exe

pid	process
684	fkp.exe

Loads dropped DLL 2 IoCs

Processes:

62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe

pid	process
1668	62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe
1668	62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe

description ioc process

File opened for modification \??\PhysicalDrive0 62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exefkp.exe

pid	process
1668	62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe
684	fkp.exe
1668	62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe

description	pid	process	target process
PID 1668 wrote to memory of 684	1668	62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe	fkp.exe
PID 1668 wrote to memory of 684	1668	62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe	fkp.exe
PID 1668 wrote to memory of 684	1668	62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe	fkp.exe
PID 1668 wrote to memory of 684	1668	62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe	fkp.exe

C:\Users\Admin\AppData\Local\Temp\62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe
"C:\Users\Admin\AppData\Local\Temp\62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\fkp.exe
"C:\Users\Admin\AppData\Local\Temp\fkp.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:684

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fkp.exe
Filesize
7KB

MD5
a4974058f1f6e7ddb9f9316f25dd84c2

SHA1
ad41a5245fc571a78ce768a22b2a5020c9459a49

SHA256
16c7096b10cb37aa25ed8f41c16591b33a3a0d5d1a5f132c67616d75acbe5ddd

SHA512
7a87db56ea397971b0fe72a6fac848f9aee7de344dfce891980eaffc250460cf3fdcff2ce0f6d46f379598f60be42940a732e4b2e91a169613da89b0f5babeda

Download Submit
\Users\Admin\AppData\Local\Temp\fkp.exe
Filesize
7KB

MD5
a4974058f1f6e7ddb9f9316f25dd84c2

SHA1
ad41a5245fc571a78ce768a22b2a5020c9459a49

SHA256
16c7096b10cb37aa25ed8f41c16591b33a3a0d5d1a5f132c67616d75acbe5ddd

SHA512
7a87db56ea397971b0fe72a6fac848f9aee7de344dfce891980eaffc250460cf3fdcff2ce0f6d46f379598f60be42940a732e4b2e91a169613da89b0f5babeda

Download Submit
\Users\Admin\AppData\Local\Temp\fkp.exe
Filesize
7KB

MD5
a4974058f1f6e7ddb9f9316f25dd84c2

SHA1
ad41a5245fc571a78ce768a22b2a5020c9459a49

SHA256
16c7096b10cb37aa25ed8f41c16591b33a3a0d5d1a5f132c67616d75acbe5ddd

SHA512
7a87db56ea397971b0fe72a6fac848f9aee7de344dfce891980eaffc250460cf3fdcff2ce0f6d46f379598f60be42940a732e4b2e91a169613da89b0f5babeda

Download Submit
memory/684-57-0x0000000000000000-mapping.dmp

Download
memory/684-60-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1668-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download
memory/1668-61-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1668-62-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1668-63-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1668-64-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads