381ea852d6a34b7a7c26064eccaf0601d643800f0787a350214ce96ed89bc480

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
09/10/2023, 03:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

381ea852d6a34b7a7c26064eccaf0601d643800f0787a350214ce96ed89bc480.exe
Size

12.1MB
MD5

64d65576b046a0ef6c31f91385a3efd5
SHA1

1795d17d509796e0e8dc70f6642ed73550b1da6d
SHA256

381ea852d6a34b7a7c26064eccaf0601d643800f0787a350214ce96ed89bc480
SHA512

728cf8903a2570682c9652947fac6caf674574e99b6546f3a77f54cbd50705a594b56d8715bd10123db5559cb7746bbe0343f59e6d9ceced6a1dff9555022f27
SSDEEP

196608:0vafTQyM7/bOCzbf0OOuHj8WxRr3g8xBxx2UHxl3c9BDalc:GafbM7TOCnD8Wr3g8xBmUHxl3c9s6

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2092	381ea852d6a34b7a7c26064eccaf0601d643800f0787a350214ce96ed89bc480.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	381ea852d6a34b7a7c26064eccaf0601d643800f0787a350214ce96ed89bc480.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2092	381ea852d6a34b7a7c26064eccaf0601d643800f0787a350214ce96ed89bc480.exe
2092	381ea852d6a34b7a7c26064eccaf0601d643800f0787a350214ce96ed89bc480.exe

C:\Users\Admin\AppData\Local\Temp\381ea852d6a34b7a7c26064eccaf0601d643800f0787a350214ce96ed89bc480.exe
"C:\Users\Admin\AppData\Local\Temp\381ea852d6a34b7a7c26064eccaf0601d643800f0787a350214ce96ed89bc480.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\E2EECore.2.7.2.dll

Filesize
8.4MB

MD5
8b6c94bbdbfb213e94a5dcb4fac28ce3

SHA1
b56102ca4f03556f387f8b30e2b404efabe0cb65

SHA256
982a177924762f270b36fe34c7d6847392b48ae53151dc2011078dceef487a53

SHA512
9d6d63b5d8cf7a978d7e91126d7a343c2f7acd00022da9d692f63e50835fdd84a59a93328564f10622f2b1f6adfd7febdd98b8ddb294d0754ed45cc9c165d25a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads