6b273cd6710214d321ebea12c2c05348f04b5a5bfe15da1d5fbd8f4c50c36f95

Analysis

max time kernel
143s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 01:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6b273cd6710214d321ebea12c2c05348f04b5a5bfe15da1d5fbd8f4c50c36f95.exe
Size

11.2MB
MD5

84e9fad559f90484f2598678f2e0208b
SHA1

e1e565fb75d6ec798ba8a216499ad4ef6beba616
SHA256

6b273cd6710214d321ebea12c2c05348f04b5a5bfe15da1d5fbd8f4c50c36f95
SHA512

34ce88136ae3de3b145b597cfe94d24ce31ff40c7a0291aab4b9d00f45f0767f915297bd839fc5e92329bb3aabd55a238ecd14fe8ba4de9a7b936e15588040f6
SSDEEP

196608:kRqt5CRk46zOnXWOEROxWUgyvK9pJkUQgJH58VWMOx:kRqt5CRkrOnXziuTvTi8UMW

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	6b273cd6710214d321ebea12c2c05348f04b5a5bfe15da1d5fbd8f4c50c36f95.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\System.22577868618391365	6b273cd6710214d321ebea12c2c05348f04b5a5bfe15da1d5fbd8f4c50c36f95.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\System.22577868618391365\19851162743151553 = "1413744139"	6b273cd6710214d321ebea12c2c05348f04b5a5bfe15da1d5fbd8f4c50c36f95.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3008	6b273cd6710214d321ebea12c2c05348f04b5a5bfe15da1d5fbd8f4c50c36f95.exe

C:\Users\Admin\AppData\Local\Temp\6b273cd6710214d321ebea12c2c05348f04b5a5bfe15da1d5fbd8f4c50c36f95.exe
"C:\Users\Admin\AppData\Local\Temp\6b273cd6710214d321ebea12c2c05348f04b5a5bfe15da1d5fbd8f4c50c36f95.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3008-0-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3008-1-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-2-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3008-3-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-4-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-5-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-6-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-7-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-8-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-9-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-10-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-11-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-12-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-13-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-14-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download
memory/3008-15-0x0000000000400000-0x0000000000F3F000-memory.dmp

Filesize
11.2MB

Download