296becf74a7989ff8f63a1c572b8b01ff0a7e8472d4d59f31bf9167ed195b2f6

Resubmissions

16/02/2023, 08:23

230216-kacqhsgf66 7

14/02/2023, 13:14

230214-qg2acach6z 7

14/02/2023, 13:10

230214-qetsgsde72 7

Analysis

max time kernel
27s
max time network
28s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
16/02/2023, 08:23

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

67cf719a695ae1b769da9253901c26d8.exe
Size

5.1MB
MD5

67cf719a695ae1b769da9253901c26d8
SHA1

c148e7823e4bd98060f1b1d402aed070f99b5902
SHA256

296becf74a7989ff8f63a1c572b8b01ff0a7e8472d4d59f31bf9167ed195b2f6
SHA512

52a82db982f67f78558933c2ea5d2df8a88a20fdbedd71fcb0cd367b7c88b91a5388aec1bf5f305b1a0e8c610d489c93149599ee0fe3136d201e2522d50a5a48
SSDEEP

98304:MspkzuYnHDsB7V7UsE/8EI79WFynJih6/BG:M2Su7VSk7wQJc60

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	67cf719a695ae1b769da9253901c26d8.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	772	AUDIODG.EXE
Token: 33	772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	772	AUDIODG.EXE

C:\Users\Admin\AppData\Local\Temp\67cf719a695ae1b769da9253901c26d8.exe
"C:\Users\Admin\AppData\Local\Temp\67cf719a695ae1b769da9253901c26d8.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:604

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1456

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x544
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:772

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/604-55-0x0000000000400000-0x0000000000B20000-memory.dmp

Filesize
7.1MB

Download
memory/604-56-0x0000000000400000-0x0000000000B20000-memory.dmp

Filesize
7.1MB

Download
memory/1456-57-0x000007FEFC251000-0x000007FEFC253000-memory.dmp

Filesize
8KB

Download