9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c

Analysis

max time kernel
37s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe
Size

1.2MB
MD5

d1c7fe76238790ed77d3aaa87338ec85
SHA1

29b38933a1ce0b5d6b24c2b4bea80e289c2e0680
SHA256

9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c
SHA512

da191169f3b1fe82cb4f72aeb320ce15eb980db37d7b4a096e73cfa75f3fd5ffc7334f7a2c96ae20acf8e87c2db01d31a5d77823604f8eb0beb9766715aa3dda
SSDEEP

24576:cJprrAQMRMKToVk8oksTlEBgJ97QZ1ngmi9sJplXgsR9Q:cJ5rmoVk/ks4ngmi9sJplXgY9Q

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1708	360.exe

Loads dropped DLL 5 IoCs

pid	Process
1612	9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe
1708	360.exe
1708	360.exe
1708	360.exe
1708	360.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	360.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WindowsUpdate.log	360.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	360.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	360.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	360.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1708	360.exe
1708	360.exe
1708	360.exe
1708	360.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 1708	1612	9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe	26
PID 1612 wrote to memory of 1708	1612	9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe	26
PID 1612 wrote to memory of 1708	1612	9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe	26
PID 1612 wrote to memory of 1708	1612	9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe	26

C:\Users\Admin\AppData\Local\Temp\9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe
"C:\Users\Admin\AppData\Local\Temp\9420482bfad0cbec392f81cc5b7a407ed571decf7b355f7fc60556d416da742c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe

Filesize
847KB

MD5
4658235b2fed592550034540004cae66

SHA1
fbc063e961a56eb208b14c87324ba2c487bab08b

SHA256
c6fdda79158c0c6ac99b45e67365725908b94fdbec8913ac0ef0b7a870e30eb0

SHA512
0a72d33fb598ea33680b7da96c57140a7446a5171a29f896d53cde2eab5edef115447bb018275f1b755cc2ac46fecfa2ea9f765cbab2cfaaddd79eb7942eafbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe

Filesize
847KB

MD5
4658235b2fed592550034540004cae66

SHA1
fbc063e961a56eb208b14c87324ba2c487bab08b

SHA256
c6fdda79158c0c6ac99b45e67365725908b94fdbec8913ac0ef0b7a870e30eb0

SHA512
0a72d33fb598ea33680b7da96c57140a7446a5171a29f896d53cde2eab5edef115447bb018275f1b755cc2ac46fecfa2ea9f765cbab2cfaaddd79eb7942eafbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\360verify.dll

Filesize
93KB

MD5
9468d919b3a6d024113d3664698ae17d

SHA1
d5d24f3d49678fb2158440e6237036031444bc32

SHA256
f0658fa84ada335776d5936c5fc6fdad95f40ee0c7b4b1faa3af61e848d9697a

SHA512
81745eb8da3bd4f3d276504838f29b573e217f9a6550d2b50a7ff116b22334bf042abc6d1f0fbf1135abc6276e819a91069b7e81ca9621ed9f34b838e95db55e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\LeakCheck.dll

Filesize
341KB

MD5
9e68d584a7e1b30a28ded41b6aa579cf

SHA1
d873112ac0dea660efdd3be2676fc89872075d76

SHA256
ad7e57ddeee403c4089630ebf7c6bc05a4a0e499a8078d676860e043508b3983

SHA512
0b98149bc1797aee111ebd4af2827a954e62d8981630c8f28c90ce9a4efa3391a54e456c999af8a408973db43742c9323f56583b4b118c820aaaad7c7fad0c5e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\360.exe

Filesize
847KB

MD5
4658235b2fed592550034540004cae66

SHA1
fbc063e961a56eb208b14c87324ba2c487bab08b

SHA256
c6fdda79158c0c6ac99b45e67365725908b94fdbec8913ac0ef0b7a870e30eb0

SHA512
0a72d33fb598ea33680b7da96c57140a7446a5171a29f896d53cde2eab5edef115447bb018275f1b755cc2ac46fecfa2ea9f765cbab2cfaaddd79eb7942eafbc

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\360verify.dll

Filesize
93KB

MD5
9468d919b3a6d024113d3664698ae17d

SHA1
d5d24f3d49678fb2158440e6237036031444bc32

SHA256
f0658fa84ada335776d5936c5fc6fdad95f40ee0c7b4b1faa3af61e848d9697a

SHA512
81745eb8da3bd4f3d276504838f29b573e217f9a6550d2b50a7ff116b22334bf042abc6d1f0fbf1135abc6276e819a91069b7e81ca9621ed9f34b838e95db55e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\LeakCheck.dll

Filesize
341KB

MD5
9e68d584a7e1b30a28ded41b6aa579cf

SHA1
d873112ac0dea660efdd3be2676fc89872075d76

SHA256
ad7e57ddeee403c4089630ebf7c6bc05a4a0e499a8078d676860e043508b3983

SHA512
0b98149bc1797aee111ebd4af2827a954e62d8981630c8f28c90ce9a4efa3391a54e456c999af8a408973db43742c9323f56583b4b118c820aaaad7c7fad0c5e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\LeakCheck.dll

Filesize
341KB

MD5
9e68d584a7e1b30a28ded41b6aa579cf

SHA1
d873112ac0dea660efdd3be2676fc89872075d76

SHA256
ad7e57ddeee403c4089630ebf7c6bc05a4a0e499a8078d676860e043508b3983

SHA512
0b98149bc1797aee111ebd4af2827a954e62d8981630c8f28c90ce9a4efa3391a54e456c999af8a408973db43742c9323f56583b4b118c820aaaad7c7fad0c5e

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\LeakCheck.dll

Filesize
341KB

MD5
9e68d584a7e1b30a28ded41b6aa579cf

SHA1
d873112ac0dea660efdd3be2676fc89872075d76

SHA256
ad7e57ddeee403c4089630ebf7c6bc05a4a0e499a8078d676860e043508b3983

SHA512
0b98149bc1797aee111ebd4af2827a954e62d8981630c8f28c90ce9a4efa3391a54e456c999af8a408973db43742c9323f56583b4b118c820aaaad7c7fad0c5e

Download Submit
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download