a46a25fa1a1f1158aee7bea74a5f75921f8b595d3ae9bd5804299ad07aa5a1e3

Analysis

max time kernel
65s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 10:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a46a25fa1a1f1158aee7bea74a5f75921f8b595d3ae9bd5804299ad07aa5a1e3.exe
Size

176KB
MD5

f0e52fc2de9822b462474c4cc62388f8
SHA1

a722b160c0e44c0e9f1bfd94e94f42e6e68590a1
SHA256

a46a25fa1a1f1158aee7bea74a5f75921f8b595d3ae9bd5804299ad07aa5a1e3
SHA512

f39f87ffad341dabe9aa3aaf2e405edbcad12cfba4cbda06a1e8a27c8c5f1fa10848ffc5277e0edefe914650ce371fc73d539f8d0b5c1c5c061a0dda834314a7
SSDEEP

3072:R7dfLpMygYkYFoSGY6D/KCCTXpmyB/1XqiuHkKLPFvo7kWKZ1lEZ:RJdMvzYFo76CgNXqPHkKLPKIWKZ1lEZ

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\physicaldrive0	a46a25fa1a1f1158aee7bea74a5f75921f8b595d3ae9bd5804299ad07aa5a1e3.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1016	a46a25fa1a1f1158aee7bea74a5f75921f8b595d3ae9bd5804299ad07aa5a1e3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1016	a46a25fa1a1f1158aee7bea74a5f75921f8b595d3ae9bd5804299ad07aa5a1e3.exe

C:\Users\Admin\AppData\Local\Temp\a46a25fa1a1f1158aee7bea74a5f75921f8b595d3ae9bd5804299ad07aa5a1e3.exe
"C:\Users\Admin\AppData\Local\Temp\a46a25fa1a1f1158aee7bea74a5f75921f8b595d3ae9bd5804299ad07aa5a1e3.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:1016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1016-54-0x00000000756B1000-0x00000000756B3000-memory.dmp

Filesize
8KB

Download
memory/1016-55-0x0000000000160000-0x00000000001B7000-memory.dmp

Filesize
348KB

Download
memory/1016-56-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1016-57-0x0000000000160000-0x00000000001B7000-memory.dmp

Filesize
348KB

Download