fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0

Analysis

max time kernel
27s
max time network
30s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
17-02-2023 21:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0.exe
Size

1.8MB
MD5

106fba8159f464f38b530a04a9807bd3
SHA1

7989d09b91a609f47dba1f8949c23864f21ccb97
SHA256

fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0
SHA512

a23997a92050ad9d603de9789d435c4bad39ea3bb89d4c221596f9dc189dbab3ce786010a9adf365dcee22d9846b265afdc0f42dae0f6268a8c1a4a64e0cad5d
SSDEEP

24576:CrEP/MK8RWmUo8TqjTz1yqO/tXN20clFutaytNtkUrYtrJ2ds+v+Z0U:CrE8W3mjvAN/tGlFuwy1rYtrKNvv

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0.exe

description ioc process

File opened for modification \??\PhysicalDrive0 fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0.exe

pid	process
1124	fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0.exe
1124	fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0.exe
1124	fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0.exe

C:\Users\Admin\AppData\Local\Temp\fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0.exe
"C:\Users\Admin\AppData\Local\Temp\fb52fcd8c2909761ee793e0ea656acc133974579dfdc47b830936aafbf6aa7f0.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:1124

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

Filesize
8KB

Download