9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c

Analysis

max time kernel
25s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 04:22

Target

9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe
Size

1.7MB
MD5

fc11deab4240106658e026d810442980
SHA1

17e614e19b1c0670968f8953eb6bfb058e7eb78a
SHA256

9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c
SHA512

5d4dfee1752b85461b008ce00d82903bc776034de1933fa2b89fa77b422ddeb04bcf498d61a025e1a674290bd9fe5d7f4d3ed83f48ed3d3bbb2bd5e3eb400b53
SSDEEP

49152:oYZMynETvDDVtPny1PuWE2NkWR0ypOpeu5gbFh:fDETDptPnSuWFNkWR0ewemgbFh

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe

description ioc process

File opened for modification \??\PhysicalDrive0 9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe

Modifies registry class 6 IoCs

Processes:

9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\Shell\Convert current file to PDF format ( FoxPDF Image to PDF Converter )\Command	9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*	9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\Shell	9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Convert current file to PDF format ( FoxPDF Image to PDF Converter )	9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Convert current file to PDF format ( FoxPDF Image to PDF Converter )\Command	9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\Convert current file to PDF format ( FoxPDF Image to PDF Converter )\Command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe \"%1\""	9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe

pid	process
1280	9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe
1280	9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe
1280	9e1ef745b2ac3263cc33ad7a6ed0076d3a1f1d4a14e6b5fdb8290ff39c23ab3c.exe

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/1280-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download