6b2cc93b90df494b04e335c2af1f0d77131bb4fc5dda6e6b994aaa29c74fd319

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

416ef1cfa32d3478860cd888a2c95f10.dll
Size

186KB
MD5

416ef1cfa32d3478860cd888a2c95f10
SHA1

41adc6292f0b413389de9f6a069a3a46dbf6639b
SHA256

6b2cc93b90df494b04e335c2af1f0d77131bb4fc5dda6e6b994aaa29c74fd319
SHA512

b721e7e7820c928407e0349889fb19904b8ff10a4a4862c38f9dbba23407b20842e95f094e4052b277f6115c993e8f3285a61330c9c936a2197e2ec95b040c00
SSDEEP

3072:KMWJLOm80sjbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7JRkvljmMQfQEhj:KP181/wvP6bQ7yMP+DE827JRkvljlDEt

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	regsvr32.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\416ef1cfa32d3478860cd888a2c95f10.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\ = "loader_c 1.0 Type Library"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{13539089-270A-449C-8C6F-DEEBDA8C2A2E}\1.0	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2368	2288	regsvr32.exe	28
PID 2288 wrote to memory of 2368	2288	regsvr32.exe	28
PID 2288 wrote to memory of 2368	2288	regsvr32.exe	28
PID 2288 wrote to memory of 2368	2288	regsvr32.exe	28
PID 2288 wrote to memory of 2368	2288	regsvr32.exe	28
PID 2288 wrote to memory of 2368	2288	regsvr32.exe	28
PID 2288 wrote to memory of 2368	2288	regsvr32.exe	28

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\416ef1cfa32d3478860cd888a2c95f10.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\416ef1cfa32d3478860cd888a2c95f10.dll
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Modifies registry class
  PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2368-0-0x0000000010000000-0x000000001002E000-memory.dmp

Filesize
184KB

Download
memory/2368-1-0x00000000001A0000-0x00000000001D0000-memory.dmp

Filesize
192KB

Download
memory/2368-2-0x00000000001D0000-0x00000000001D3000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads