d11fa3c76f2c301bd3c2dc33c7736e6c0ed46e989d7ef76369823c33ec0f7496

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2023, 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Aws2.2.exe
Size

696KB
MD5

54c63e845b75fd07f48739e5d2487ca1
SHA1

e0a8c295ea69905c83aec0603ac0bccc9fb981a3
SHA256

d11fa3c76f2c301bd3c2dc33c7736e6c0ed46e989d7ef76369823c33ec0f7496
SHA512

3f671c41c112ad7b0b4011a7dafd102de8912f1d81c8bc4e21a5ae7de560f6fdb0bb2a770647b7e60c8e082989a8d60ca00cfd00eeabe9091908ba47e86713b9
SSDEEP

12288:fXMhkFCmmrYcJ5wc68dgeSpAp10BWEhQaV+aGEcC7tC5bT9kZetKg3dBdHDit1w0:EyFCmJcTwb8xXAWEqlaGB0yTcgKg3dBI

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	Aws2.2.exe
File opened (read-only)	\??\o:	Aws2.2.exe
File opened (read-only)	\??\q:	Aws2.2.exe
File opened (read-only)	\??\b:	Aws2.2.exe
File opened (read-only)	\??\k:	Aws2.2.exe
File opened (read-only)	\??\r:	Aws2.2.exe
File opened (read-only)	\??\u:	Aws2.2.exe
File opened (read-only)	\??\v:	Aws2.2.exe
File opened (read-only)	\??\a:	Aws2.2.exe
File opened (read-only)	\??\h:	Aws2.2.exe
File opened (read-only)	\??\j:	Aws2.2.exe
File opened (read-only)	\??\p:	Aws2.2.exe
File opened (read-only)	\??\s:	Aws2.2.exe
File opened (read-only)	\??\t:	Aws2.2.exe
File opened (read-only)	\??\w:	Aws2.2.exe
File opened (read-only)	\??\x:	Aws2.2.exe
File opened (read-only)	\??\z:	Aws2.2.exe
File opened (read-only)	\??\e:	Aws2.2.exe
File opened (read-only)	\??\g:	Aws2.2.exe
File opened (read-only)	\??\i:	Aws2.2.exe
File opened (read-only)	\??\l:	Aws2.2.exe
File opened (read-only)	\??\n:	Aws2.2.exe
File opened (read-only)	\??\y:	Aws2.2.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Aws2.2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1872	Aws2.2.exe
1872	Aws2.2.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1872	Aws2.2.exe
1872	Aws2.2.exe

C:\Users\Admin\AppData\Local\Temp\Aws2.2.exe
"C:\Users\Admin\AppData\Local\Temp\Aws2.2.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-133-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/1872-134-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/1872-135-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/1872-136-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/1872-138-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download
memory/1872-141-0x0000000000400000-0x000000000059E000-memory.dmp

Filesize
1.6MB

Download