4cc37020c8c53248e9322334549763e12ed7f58dad08b5b924c77f9166ca49fb

Analysis

max time kernel
21s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-02-2023 22:08

Target

Game.exe
Size

57KB
MD5

4cc0a3cb0be1cb00c8feaa88684ec5e0
SHA1

6d562ce66f9a4a9fdd0315afa01388eceac659af
SHA256

b7aa5e1714e0fc539bc1f6bc3ec50a2d393683fb3e943fa72e4d25bf7fd03096
SHA512

fe7355a7b20d99b401fe7bb10adea562a070cda841e23580baeae99a3c537a2c3ad6db03e96e379a89847d062c7d8a37b8d19b736bd3a980a014bf4f53814adf
SSDEEP

768:XnlWv8mkZ4fklKF6+eT3u5LXcFRqzjXmsVmrowxGLvs3TLGlKbFv5M:3lWvkZ+I+4u5LXcs7jVStGLvdo5

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

Game.exe

description ioc process

File opened for modification \??\PhysicalDrive0 Game.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Game.exe

Modifies registry class 3 IoCs

Processes:

Game.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	Game.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	Game.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	Game.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AUDIODG.EXE

description	pid	process
Token: 33	1092	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1092	AUDIODG.EXE
Token: 33	1092	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1092	AUDIODG.EXE

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

Game.exe

pid process

1252 Game.exe

pid	process
1252	Game.exe

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x544
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1092

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1252-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1252-55-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download
memory/1252-56-0x0000000002C60000-0x0000000002C64000-memory.dmp

Filesize
16KB

Download
memory/1252-57-0x0000000073B50000-0x0000000073C41000-memory.dmp

Filesize
964KB

Download
memory/1252-58-0x0000000010000000-0x0000000010324000-memory.dmp

Filesize
3.1MB

Download