Overview

overview

10

Static

static

9f1394269d...dd.exe

windows7-x64

10

9f1394269d...dd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    47s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    05-12-2022 07:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9f1394269d0cddb87380fa9fe88831036de458ac6fe1b3f517cb7ae60656bedd.exe

  • Size

    1.1MB

  • MD5

    f0a6c4647312bff08c613178893702e1

  • SHA1

    904dc8720fa1a9ed98d032d9f56ffbff6410757a

  • SHA256

    9f1394269d0cddb87380fa9fe88831036de458ac6fe1b3f517cb7ae60656bedd

  • SHA512

    a489b6bb24dcbdb9b1667e6af37d8df53dcc35901aa05e9c6cf43001841f158057bbdd4564c81801debb55b674864107c03f9c0e8ea99d966ebc38bde8fa4ba3

  • SSDEEP

    24576:Chebrn/mG9Pwrn/POzMQGEvGEg5inu3i6ZTdDiUSgwt9faL+Wdi3oBMct3lVW6i8:ChArn/X9Pwrn/POzMQGEvGE0inu3i6ZH

Score
10/10
bootkitevasionpersistence

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Drops desktop.ini file(s) 64 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops autorun.inf file 1 TTPs 35 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 64 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f1394269d0cddb87380fa9fe88831036de458ac6fe1b3f517cb7ae60656bedd.exe
    "C:\Users\Admin\AppData\Local\Temp\9f1394269d0cddb87380fa9fe88831036de458ac6fe1b3f517cb7ae60656bedd.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Loads dropped DLL
    • Drops desktop.ini file(s)
    • Writes to the Master Boot Record (MBR)
    • Drops autorun.inf file
    • Drops file in Program Files directory
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\Users\Admin\AppData\Local\Temp\temp.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1992
      • C:\Windows\SysWOW64\cacls.exe
        cacls "C:\Program Files\Windows Media Player\a" /d everyone /e
        3⤵
          PID:1496
      • C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡
        "C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡" pid 960"C:\Users\Admin\AppData\Local\Temp\9f1394269d0cddb87380fa9fe88831036de458ac6fe1b3f517cb7ae60656bedd.exe"
        2⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of SetWindowsHookEx
        PID:1676

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Replication Through Removable Media

    1
    T1091

    Execution

    Persistence

    Winlogon Helper DLL

    1
    T1004

    Hidden Files and Directories

    1
    T1158

    Bootkit

    1
    T1067

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Hidden Files and Directories

    1
    T1158

    Credential Access

    Discovery

    Lateral Movement

    Replication Through Removable Media

    1
    T1091

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡
      Filesize

      1.1MB

      MD5

      f0a6c4647312bff08c613178893702e1

      SHA1

      904dc8720fa1a9ed98d032d9f56ffbff6410757a

      SHA256

      9f1394269d0cddb87380fa9fe88831036de458ac6fe1b3f517cb7ae60656bedd

      SHA512

      a489b6bb24dcbdb9b1667e6af37d8df53dcc35901aa05e9c6cf43001841f158057bbdd4564c81801debb55b674864107c03f9c0e8ea99d966ebc38bde8fa4ba3

      Download Submit
    • C:\Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡
      Filesize

      1.1MB

      MD5

      f0a6c4647312bff08c613178893702e1

      SHA1

      904dc8720fa1a9ed98d032d9f56ffbff6410757a

      SHA256

      9f1394269d0cddb87380fa9fe88831036de458ac6fe1b3f517cb7ae60656bedd

      SHA512

      a489b6bb24dcbdb9b1667e6af37d8df53dcc35901aa05e9c6cf43001841f158057bbdd4564c81801debb55b674864107c03f9c0e8ea99d966ebc38bde8fa4ba3

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\E_N4\Md5.fne
      Filesize

      28KB

      MD5

      992322b55f2684fe4c83b8e94dd54adb

      SHA1

      0990c5d0da44f3dfa45208c8d7d6ca27614dc165

      SHA256

      d3204ab23cfb93ec59c26624b46c436da7545bb91cbca0d9801b8e3ac0df3ead

      SHA512

      471ae13171f3f15f53126b04ada3157b4d194cec2d6b14502b1ea17962b163360f7e6a60187c1d15795c61955a64b19c1c68fcc5af6c7ee80ba3be6af1dcbf5b

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\E_N4\eAPI.fne
      Filesize

      332KB

      MD5

      3102c454a9543e58fe3ad5f783f5a690

      SHA1

      dc98fe9c47b1b4123ebe5e0132c0ba2d391570e9

      SHA256

      039670ca85824d4850e737a308aa8e628c83551a21711d549b17068fbdb2d9d9

      SHA512

      5b3218804054f0a3c24f3705c4902f333db0fc7b39aa81c2b71fefa0bc7d2a2ded14a13ab01ef3627889ff167ee7f565401ad0e5b5c9697d40f14f67228b9807

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\E_N4\internet.fne
      Filesize

      192KB

      MD5

      c1180974dd8a7c6d9f8fcc13096b4f7a

      SHA1

      9d50021334248bf0c752b3ed34deed48325da05c

      SHA256

      5b1ff0cabb2384f4b6385c1acce1d5e3a9d7b8e0403e2224cd1ab9722a599d3d

      SHA512

      c8b938bf172b9d2ccfaea34ff7cfddc9eaab8a9416a07e458bd34dfed2ea18de66d23dbaa9f15c2faf1009e00a8dfca3168ab41f02ef28e97c9197c3ca6943e9

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr
      Filesize

      1.0MB

      MD5

      4b30dbe1a79b2b7572ff637cb3765ced

      SHA1

      b08eba0e9bdb62d426db8d2b3d451152a56f79a1

      SHA256

      4208bdf90e97398a452d459d89562bda361bc6e911a385c4e31481a776f69e6d

      SHA512

      40e99c4a9d160a734a1675d75209dd88c7389c95cf0d0b6101f7e9edb2f3ebfe85e7170f0f4bae8a2e9533048bd5ecd414797b02ef257aecd90431f0c29ccfce

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\temp.bat
      Filesize

      72B

      MD5

      28b4bca46f12e840a196a027b05b1675

      SHA1

      3d1c1c0ac44bf8db45d579287dbd0ecc26ddcbfa

      SHA256

      aacf79a3eb763b78eccfe7ef16c9b4d80aa3bd07e70b2a87f6ba551bd78ea808

      SHA512

      22fe6b9a3b36b77b4ac39d2a96fd5a944bf756b885318f6410e1c57f79a27fa65aba1ec6e24fa7ab318330de24ab86b9327ed770480fe7c1188483a0033a207f

      Download Submit
    • \Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡
      Filesize

      1.1MB

      MD5

      f0a6c4647312bff08c613178893702e1

      SHA1

      904dc8720fa1a9ed98d032d9f56ffbff6410757a

      SHA256

      9f1394269d0cddb87380fa9fe88831036de458ac6fe1b3f517cb7ae60656bedd

      SHA512

      a489b6bb24dcbdb9b1667e6af37d8df53dcc35901aa05e9c6cf43001841f158057bbdd4564c81801debb55b674864107c03f9c0e8ea99d966ebc38bde8fa4ba3

      Download Submit
    • \Program Files\Windows Media Player\a\b\9\d\b\5\f\a\1\5\6\2\e\c\8\f\5\d\6\3\2\c\b\5\c\b\2\6\9\3\a\4\autorun.inf\svchost.exe¡¡
      Filesize

      1.1MB

      MD5

      f0a6c4647312bff08c613178893702e1

      SHA1

      904dc8720fa1a9ed98d032d9f56ffbff6410757a

      SHA256

      9f1394269d0cddb87380fa9fe88831036de458ac6fe1b3f517cb7ae60656bedd

      SHA512

      a489b6bb24dcbdb9b1667e6af37d8df53dcc35901aa05e9c6cf43001841f158057bbdd4564c81801debb55b674864107c03f9c0e8ea99d966ebc38bde8fa4ba3

      Download Submit
    • \Users\Admin\AppData\Local\Temp\E_N4\Md5.fne
      Filesize

      28KB

      MD5

      992322b55f2684fe4c83b8e94dd54adb

      SHA1

      0990c5d0da44f3dfa45208c8d7d6ca27614dc165

      SHA256

      d3204ab23cfb93ec59c26624b46c436da7545bb91cbca0d9801b8e3ac0df3ead

      SHA512

      471ae13171f3f15f53126b04ada3157b4d194cec2d6b14502b1ea17962b163360f7e6a60187c1d15795c61955a64b19c1c68fcc5af6c7ee80ba3be6af1dcbf5b

      Download Submit
    • \Users\Admin\AppData\Local\Temp\E_N4\Md5.fne
      Filesize

      28KB

      MD5

      992322b55f2684fe4c83b8e94dd54adb

      SHA1

      0990c5d0da44f3dfa45208c8d7d6ca27614dc165

      SHA256

      d3204ab23cfb93ec59c26624b46c436da7545bb91cbca0d9801b8e3ac0df3ead

      SHA512

      471ae13171f3f15f53126b04ada3157b4d194cec2d6b14502b1ea17962b163360f7e6a60187c1d15795c61955a64b19c1c68fcc5af6c7ee80ba3be6af1dcbf5b

      Download Submit
    • \Users\Admin\AppData\Local\Temp\E_N4\eAPI.fne
      Filesize

      332KB

      MD5

      3102c454a9543e58fe3ad5f783f5a690

      SHA1

      dc98fe9c47b1b4123ebe5e0132c0ba2d391570e9

      SHA256

      039670ca85824d4850e737a308aa8e628c83551a21711d549b17068fbdb2d9d9

      SHA512

      5b3218804054f0a3c24f3705c4902f333db0fc7b39aa81c2b71fefa0bc7d2a2ded14a13ab01ef3627889ff167ee7f565401ad0e5b5c9697d40f14f67228b9807

      Download Submit
    • \Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr
      Filesize

      1.0MB

      MD5

      4b30dbe1a79b2b7572ff637cb3765ced

      SHA1

      b08eba0e9bdb62d426db8d2b3d451152a56f79a1

      SHA256

      4208bdf90e97398a452d459d89562bda361bc6e911a385c4e31481a776f69e6d

      SHA512

      40e99c4a9d160a734a1675d75209dd88c7389c95cf0d0b6101f7e9edb2f3ebfe85e7170f0f4bae8a2e9533048bd5ecd414797b02ef257aecd90431f0c29ccfce

      Download Submit
    • \Users\Admin\AppData\Local\Temp\E_N4\krnln.fnr
      Filesize

      1.0MB

      MD5

      4b30dbe1a79b2b7572ff637cb3765ced

      SHA1

      b08eba0e9bdb62d426db8d2b3d451152a56f79a1

      SHA256

      4208bdf90e97398a452d459d89562bda361bc6e911a385c4e31481a776f69e6d

      SHA512

      40e99c4a9d160a734a1675d75209dd88c7389c95cf0d0b6101f7e9edb2f3ebfe85e7170f0f4bae8a2e9533048bd5ecd414797b02ef257aecd90431f0c29ccfce

      Download Submit
    • memory/960-74-0x0000000001E80000-0x0000000001EE2000-memory.dmp
      Filesize

      392KB

      Download
    • memory/960-73-0x0000000000400000-0x0000000000462000-memory.dmp
      Filesize

      392KB

      Download
    • memory/960-55-0x00000000757A1000-0x00000000757A3000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1496-66-0x0000000000000000-mapping.dmp
      Download
    • memory/1676-71-0x0000000001DB0000-0x0000000001E13000-memory.dmp
      Filesize

      396KB

      Download
    • memory/1676-75-0x0000000000400000-0x0000000000462000-memory.dmp
      Filesize

      392KB

      Download
    • memory/1676-60-0x0000000000000000-mapping.dmp
      Download
    • memory/1992-57-0x0000000000000000-mapping.dmp
      Download