85ff9e7c641fee428246d88582ca2b11e0a3a9626e5e36af04657a1ed497d418

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
02-04-2023 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85ff9e7c641fee428246d88582ca2b11e0a3a9626e5e36af04657a1ed497d418.exe
Size

3.3MB
MD5

99b52d81a9973e926c9037324b191e96
SHA1

a30987dabefdcd7c6a1536c3299c72595069dcb8
SHA256

85ff9e7c641fee428246d88582ca2b11e0a3a9626e5e36af04657a1ed497d418
SHA512

63b87f583821748b56b1c033f8bf52c4b6e39f9a4f8bdae1a736913d6b84586ba28e1fbacc4c8d245aaa26afb8d02c893432cb9569cd3588307586a59b28a9c2
SSDEEP

49152:Ok0XRCADgKoiGDurmLIAR7lJI+yO15xzJFcxLo/qD3h:PygKoXDurAIANlJTt15BUe/sh

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

85ff9e7c641fee428246d88582ca2b11e0a3a9626e5e36af04657a1ed497d418.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 85ff9e7c641fee428246d88582ca2b11e0a3a9626e5e36af04657a1ed497d418.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	85ff9e7c641fee428246d88582ca2b11e0a3a9626e5e36af04657a1ed497d418.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

85ff9e7c641fee428246d88582ca2b11e0a3a9626e5e36af04657a1ed497d418.exe

pid	process
2044	85ff9e7c641fee428246d88582ca2b11e0a3a9626e5e36af04657a1ed497d418.exe
2044	85ff9e7c641fee428246d88582ca2b11e0a3a9626e5e36af04657a1ed497d418.exe

C:\Users\Admin\AppData\Local\Temp\85ff9e7c641fee428246d88582ca2b11e0a3a9626e5e36af04657a1ed497d418.exe
"C:\Users\Admin\AppData\Local\Temp\85ff9e7c641fee428246d88582ca2b11e0a3a9626e5e36af04657a1ed497d418.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2044

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2044-54-0x0000000000400000-0x0000000001011000-memory.dmp

Filesize
12.1MB

Download