ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368

Analysis

max time kernel
58s
max time network
33s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
07/12/2022, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe
Size

242KB
MD5

7a25c532e15c5c9102c871bad50e37e7
SHA1

d3df615a049832ffaf0ee9477c45967c6ed1115a
SHA256

ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368
SHA512

45b674db70deec6334dc30783947c36bfbc68a525d049a612bd7cc1be5a8bbe3b220eeea22f486635006d2b1aa139b438194d42ff5ae36148e9ae08fc8a01151
SSDEEP

6144:1MV269J/3fsWnVW5GJZ2tNYLj8Mfsln2qjHdKrUq1c:1iBUOVzYKj86sN2qTdKrUqC

Score

10^/10

bootkit persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "userinit.exe,C:\\Windows\\system32\\sdra64.exe,"	ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sdra64.exe	ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe
File created	C:\Windows\SysWOW64\sdra64.exe	ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1192	ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe
1192	ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe

C:\Users\Admin\AppData\Local\Temp\ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe
"C:\Users\Admin\AppData\Local\Temp\ea51e21db7bd7c36d4af7eb71207cdd9fd42ac831db74e75eb9a1ed914d1d368.exe"
1⤵
- Modifies WinLogon for persistence
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-54-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1192-56-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/1192-57-0x0000000074FD1000-0x0000000074FD3000-memory.dmp

Filesize
8KB

Download
memory/1192-58-0x0000000001D20000-0x0000000001D36000-memory.dmp

Filesize
88KB

Download
memory/1192-59-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download