9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac

Analysis

max time kernel
135s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
04-06-2023 04:35

Target

9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe
Size

1.9MB
MD5

3fabb84033209a2e4e64f8bcd2fce402
SHA1

5c03d4b2c9b87f7f66f34dcb8717df71554b5fd7
SHA256

9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac
SHA512

eee5481d1891ee64972501eccf0f07fdda5178a6cfadae036be6a9ac74c365dc66e971cb3036d7acac5872b8acbe8f69cf16ecc30e0f394c289b62df810897ec
SSDEEP

49152:NhlbR+eMP/ij2JxPZfypY8/JSQfzkVRaDCVvrc:Nh+PC+xPZfypY8/boygjc

Score

6^/10

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe

description ioc process

File opened for modification \??\PhysicalDrive0 9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe

Modifies registry class 6 IoCs

Processes:

9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile\isogg = "alrGady"	9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8	9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\EditFlags = "65536"	9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.Sheet.8\EditFlags = "65536"	9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\PowerPoint.Show.8\EditFlags = "65536"	9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ywsfile	9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe

pid	process
4228	9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe
4228	9a782d3f6800239cbaaf4d051e591583a3ff3f88e0ee7ddb47612d4524542bac.exe

Initial Access

Execution

Persistence

Bootkit

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

memory/4228-133-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/4228-135-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Filesize
4KB

Download
memory/4228-136-0x0000000000400000-0x0000000000704000-memory.dmp

Filesize
3.0MB

Download