0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3

Analysis

max time kernel
150s
max time network
50s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08-06-2023 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
Size

1015KB
MD5

8bb055bce83cc5e64e9505b2e863aa16
SHA1

46ec2fb8d74d1075b6f31c4e4dda18b308cecd34
SHA256

0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3
SHA512

62ccdb669d6db6bb09581b5afc325f22dd487d221e9f78d48b0d8f2c1526b5fac3282e812ae54d6abb050ce96a35103e277e77e6422c888d3bfbee5cb70fe804
SSDEEP

24576:RUDM+QgoVymNzBku/wK4LeEun/gt1NhJZ1miRd7Ch86Y4w/ZW:RNhVTz6A3Eu/gDDJZ8iHK7Yl4

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe

description ioc process

File opened for modification \??\PhysicalDrive0 0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe

Modifies Control Panel 8 IoCs

evasion

Processes:

0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Control Panel\International\iTimePrefix = "0"	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Control Panel\International\sTime = ":"	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Control Panel\International\sShortDate = "yyyy-MM-dd"	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Control Panel\International\iDate = "2"	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Control Panel\International\sDate = "-"	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Control Panel\International\sTimeFormat = "HH:mm:ss"	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Control Panel\International\iTime = "1"	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Control Panel\International\iTLZero = "1"	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe

pid	process
1744	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
1744	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
1744	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
1744	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe

pid	process
1744	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
1744	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
1744	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
1744	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe

pid	process
1744	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
1744	0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe

C:\Users\Admin\AppData\Local\Temp\0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe
"C:\Users\Admin\AppData\Local\Temp\0d034a76683609d7e733cdccb72aecd63a219364d8c394b9828a72263f0078e3.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies Control Panel
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1744-54-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/1744-55-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1744-56-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/1744-60-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/1744-63-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/1744-66-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download
memory/1744-69-0x0000000000400000-0x0000000000824000-memory.dmp

Filesize
4.1MB

Download