46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
29-03-2023 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe
Size

5.5MB
MD5

af7d653c5b1820e024900ae54cfdcd90
SHA1

fa805aee94e55c5e4c0c9ecc7c784860064bf9b2
SHA256

46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d
SHA512

21759ace404871ef3f158a77ffdbe5205051cfb96b48839a1e53fc8d969154d658d15d962d4b2b44e233fb2e08ea6d54f93a7ed9ea49fd43be49e5fab4083a6c
SSDEEP

98304:iOtNGVvfLObA94jMg7d988Z+29mMN9bCABGf5w12WP6VCzrPt4lsinrh:3tKfLL94jXg29Xj+h546oz+S8rh

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

Processes:

46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe

pid	process
1284	46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe
1284	46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe

description ioc process

File opened for modification \??\PhysicalDrive0 46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe

pid process

1284 46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe

pid	process
1284	46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe
1284	46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe

C:\Users\Admin\AppData\Local\Temp\46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe
"C:\Users\Admin\AppData\Local\Temp\46eeaaec5999a27ae6e6b9e31bd90fabd756c2938455299ee20c6f0929cf0f5d.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1284

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsdA6F.tmp\insthelper.dll
Filesize
2.7MB

MD5
1eb8a3620d689a8daff118422341b60d

SHA1
ac647d240f358f564a335b817154009c4c66d41b

SHA256
8416dc736c80e69a480fc75f3376573f19a7a3e3881217f954f2fa91e6101893

SHA512
2a3d48225022e8a9cf9a701eeb09622d77ff2cdfce0a3534eaecb458fd3cad3d959af90f8dd4496d7df97a23036d85ddb78f41c21d8bb6c2a2eb418eee8ac54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdA6F.tmp\res\skin\btn_close.png
Filesize
1KB

MD5
d6d22365523a1dd214388b5335366ae4

SHA1
8a0f196a3a728bef47a3aeb07cff55259d76aba5

SHA256
141a2c83dd24e39b9f9e15e30b9a6bc860aeb36ed42e945ab35107c9f75ea285

SHA512
f606065c3f8b61398820de73d8d6b0e803be321e6859af25037eabe68f01a34c894e0809f785426d2f9e6c8246e9fc2aef34190b9f9e122acc2cef3c99f46168

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA6F.tmp\System.dll
Filesize
22KB

MD5
a321954c01a0fe650a9f73975243e22f

SHA1
cbdaadb3f5183a50cfba66be70249f54d6dfda57

SHA256
5e3cabdfdffbaaf3a43c9b8fb8eeae99f818ff9f8c0a9ab7c516b9393fa552de

SHA512
cdc5a3c270da0717c301492581687685bd2d7399d4166371d74886722009f6a8e93670c631230ae6fa35121c049ca38d94b27d5e52d6d95cda68fc6d0ba229a7

Download Submit
\Users\Admin\AppData\Local\Temp\nsdA6F.tmp\insthelper.dll
Filesize
2.7MB

MD5
1eb8a3620d689a8daff118422341b60d

SHA1
ac647d240f358f564a335b817154009c4c66d41b

SHA256
8416dc736c80e69a480fc75f3376573f19a7a3e3881217f954f2fa91e6101893

SHA512
2a3d48225022e8a9cf9a701eeb09622d77ff2cdfce0a3534eaecb458fd3cad3d959af90f8dd4496d7df97a23036d85ddb78f41c21d8bb6c2a2eb418eee8ac54b

Download Submit