bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe
Size

421KB
MD5

2191b9f9105f24232a91c030ee843f95
SHA1

a6edb3ce6f9f0b07c7786c301710ce78007fb094
SHA256

bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad
SHA512

96d617a464ae965d6aa21a0c68c92fbfb390f778fdf13d947174f07cfc0db5159e783ede9f92146429be586d62dae17d4ad67c01ce5f423a80fce79f2406fbbc
SSDEEP

12288:hEfrpWmQBXPi7+eoJ75WTE4DQFu/U3buRKlemZ9DnGAeduu+fz6h4C:WjpWmQZPe+4T1uzzk

Score

8^/10

bootkit persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

New Service
T1050
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe

description ioc process

File opened for modification \??\PhysicalDrive0 bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe
Drops file in System32 directory 1 IoCs

Processes:

bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe

description ioc process

File created C:\Windows\SysWOW64\at.bat bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1612 sc.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe

description	ioc	process
File created	C:\Windows\SysWOW64\at.bat	bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe

pid	process
1612	sc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	1584	bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe
Token: SeIncBasePriorityPrivilege	1584	bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe
Token: SeIncBasePriorityPrivilege	1584	bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.execmd.exe

description	pid	process	target process
PID 1584 wrote to memory of 1172	1584	bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe	cmd.exe
PID 1584 wrote to memory of 1172	1584	bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe	cmd.exe
PID 1584 wrote to memory of 1172	1584	bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe	cmd.exe
PID 1584 wrote to memory of 1172	1584	bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe	cmd.exe
PID 1172 wrote to memory of 1612	1172	cmd.exe	sc.exe
PID 1172 wrote to memory of 1612	1172	cmd.exe	sc.exe
PID 1172 wrote to memory of 1612	1172	cmd.exe	sc.exe
PID 1172 wrote to memory of 1612	1172	cmd.exe	sc.exe

C:\Users\Admin\AppData\Local\Temp\bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe
"C:\Users\Admin\AppData\Local\Temp\bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Windows\system32\at.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\SysWOW64\sc.exe
sc create Windriversrv32 start= auto displayname= WinDriver32 binpath= "C:\Users\Admin\AppData\Local\Temp\bb07ed5e931d63b1313ce016feb64416343ce724d2744bb458146b54acd5c9ad.exe -start"
3⤵
- Launches sc.exe
PID:1612

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

T1050

Bootkit

T1067

Privilege Escalation

New Service

T1050

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\at.bat
Filesize
203B

MD5
3f8ce1300bded49117dc3113efee51fd

SHA1
b21dba7de37a7b8e4aab582983e4902a775dc2e0

SHA256
828d1d44f0def28c4a086dfeaa80895ac777950031e82e9fba21d2fa7fd65786

SHA512
964b0f19e52350afeb830a2b30ffb6ec74bd1c42950a499ed447aaf6ab41bdff2a1ac7364d7195c089b623c1e5a73ed17a916131f8fcf767c3da2bbc07f56519

Download Submit
memory/1172-54-0x0000000000000000-mapping.dmp

Download
memory/1612-56-0x0000000000000000-mapping.dmp

Download