Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
25/12/2023, 13:20
General
-
Target
2141803ac1964b3aac1d8dc536d28ccc.exe
-
Size
1.2MB
-
MD5
2141803ac1964b3aac1d8dc536d28ccc
-
SHA1
131856598cb6dea55ef0f6e3f555825a9f7655c3
-
SHA256
7a4f56266c0894612e9c289a19c63d46ab615679cade1ea9b8f7edb31e200e51
-
SHA512
25917c129040a652f8d11def20193d972b4ae54ed72e8792b4f323da50531f2805a906d36c2597b13e700d34390a9a09d585a16cccf6c0a24cee568fecbed113
-
SSDEEP
24576:wm5TW9b2aHLlc5nVK3kSLcOY1MdF5MfSe54pXl88M69DTLx:Z5Tqbtrl4nVK3kS+14F5i54pyN6DXx
Malware Config
Signatures
-
Executes dropped EXE 8 IoCs
-
Loads dropped DLL 51 IoCs
-
Writes to the Master Boot Record (MBR) 1 TTPs 9 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 16 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious use of SetWindowsHookEx 56 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2141803ac1964b3aac1d8dc536d28ccc.exe"C:\Users\Admin\AppData\Local\Temp\2141803ac1964b3aac1d8dc536d28ccc.exe"1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData\Local\Temp\2141803ac1964b3aac1d8dc536d28ccc2⤵
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA3⤵
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA4⤵
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA5⤵
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE5⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE6⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA7⤵
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE7⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA8⤵
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE8⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA9⤵
-
-
C:\Windows\SysWOW64\XP-AB9DB5FA.EXEC:\Windows\system32\XP-AB9DB5FA.EXE9⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
-
-
-
-
-
C:\Windows\SysWOW64\explorer.exeexplorer C:\Windows\SysWOW64\XP-AB9DB5FA6⤵
-
-
-
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
164KB
MD5a85d63acefa7a6fa639787e364c16892
SHA186ec32360c7ec9941b9411009de6aad0c83de46f
SHA256d0b26b744a94a6dc22eba1b79089c4e1f45db18a68a9b02f58f017b94873dcb8
SHA512fd12fbeab738358b47836badaf635511ea819fb5a35de4065b68d9b6f7e0f5eb443a7363164f32e8308701e78f2279c9c481038d09a2aa92a4ec184a91a2b9e8
-
Filesize
316KB
MD525b794b18bd8d03dc9530111cbce4173
SHA1a6774d62bd1e9497fdfe6c61c495011fc6c274c6
SHA25681757b48f2caecd6fd4f6699906e9320704c10b5c5dadc6c796b9809f0359ee4
SHA5125892dc3c681571b2130695c4e8f598e732462746b9f5b8e7689108e393fb6d4edc32c97ef1f39f0c0abc901a590677f92c1abd1b809e5a875d025f4131d831ac
-
Filesize
180KB
MD556e9e121d68b5631a360d56b2ef4777f
SHA1e9d11a2baf46769c90ee1671cd17072efd8cfb52
SHA256c247997b04fc5535bb07ab43c3628326c6365aa6a0bd82a6f380b8ab66a09d2f
SHA5121ef52e0283d286a308fa1c927ff12aa43975a49d94d9386ee4a02b7e4f47de2e239a340a4427534c73c0039ea2c249e91b68f2dce1dfebf13c9879c4ea60b97e
-
Filesize
72KB
MD5c4337f54ceb6765fda33f96b8408c013
SHA1242e447d71a346366526a721532b0d47d5d62239
SHA256a3525832c5922696002c33ca8658a53a3bbcdd46a1e172ee1f5e815f037b7c08
SHA5122bc2d4648b971f94e789815ce946578d412b585158056f10d2be147e194dfa8f4bd211eecb86b76aa78233da72b2544398945ca2850268109c6f3ef7e44a8c9c
-
Filesize
128KB
MD5da4271fe109cb1b3838a9b2bc234b9c3
SHA171e920619329b417fd6f4a0e2435405e64d11572
SHA2565f38264d850a20b06bcd94daa335a764df5788d00e4c32b172421dbe92d0055d
SHA512579574ad4dc2f68abb2a1ef886d0ef30098175538bfe07e0d1e153b6034b7ad622dd5d4684275d78433fdc2c1bf75977b7f9f5eb82eed677f33ab77d1bcdcdc4
-
Filesize
260KB
MD5ce2f773275d3fe8b78f4cf067d5e6a0f
SHA1b7135e34d46eb4303147492d5cee5e1ef7b392ab
SHA256eb8099c0ad2d82d9d80530443e2909f3b34be0844d445e844f1c994476c86d2d
SHA512d733dc01c047be56680629a385abdd2aa1598a2b5459269028446da9097b6f6c1e7ade5b74e3ac3809dd8a3f8d1cbbe7fd669f2762be61f9c38fd4a2cca9e063
-
Filesize
112KB
MD56d4b2e73f6f8ecff02f19f7e8ef9a8c7
SHA109c32ca167136a17fd69df8c525ea5ffeca6c534
SHA256fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040
SHA5122fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04
-
Filesize
1.0MB
MD51081d7eb7a17faedfa588b93fc85365e
SHA1884e264fa37bfb9e71d24f3f5c7554fdf94a8b9f
SHA2560351d055cf1e194302ab125cc93208a8c733efb45dc301ca6e7e2a4051f411e0
SHA5121ff9e7c495b9e005c8d3b56219794c31d804fe1944429e3d4fe013fd8fcb3f51c02b588748c7d9d869fdb115851932e8db4e6792aecd9c83f28237702582ba81
-
Filesize
42KB
MD5538a5028a6e79d576f94fba4770dd188
SHA13aa7cce6dabd7480402272e60e6ccef66c8da52a
SHA2563542c0ed6bd770292b7af0242aded4b3f758a4e7e7d04bfc6fb5dc9430d53c61
SHA5128db0c83380a187ecdfa252af94e5e63adb6c839f898735c51ab0a30270748ad9c9fd3860a22ecd9f4413753a836cd1b168762c2d410c94e2dad26861ffbbb8d8
-
Filesize
40KB
MD5d54753e7fc3ea03aec0181447969c0e8
SHA1824e7007b6569ae36f174c146ae1b7242f98f734
SHA256192608ff371400c1529aa05f1adba0fe4fdd769fcbf35ee5f8b4f78a838a7ec9
SHA512c25ed4cb38d5d5e95a267979f0f3f9398c04a1bf5822dceb03d6f6d9b4832dfb227f1e6868327e52a0303f45c36b9ba806e75b16bd7419a7c5203c2ecbae838f
-
Filesize
1.2MB
MD52141803ac1964b3aac1d8dc536d28ccc
SHA1131856598cb6dea55ef0f6e3f555825a9f7655c3
SHA2567a4f56266c0894612e9c289a19c63d46ab615679cade1ea9b8f7edb31e200e51
SHA51225917c129040a652f8d11def20193d972b4ae54ed72e8792b4f323da50531f2805a906d36c2597b13e700d34390a9a09d585a16cccf6c0a24cee568fecbed113
-
Filesize
320KB
MD50fb5030463d45c33171302db37c3c2d3
SHA16be3f8bcc6550467cd630ab88714e888ab6037da
SHA256324ce171c5767b0a7df186b949a98066e8dce22b0552e918045c036c625ccc5e
SHA51240775ddf831ed680fd9309a26ae68ec66dbe7696e5880042003114b33474ece5e0b4269da724f878aedfd1da608e09c4ced38068591c116c4ae2ec854815414a
-
Filesize
192KB
MD50e021349585de5addba633527468c184
SHA17b8564331343d978a9c71f04ced172f5a30075d1
SHA25602f13104982c66f3cba2400dbf565253cde6d36407c9ff0704e08f6ea866d326
SHA512d314b50b02eeb962bf6473c8059d5297b4fbe46950b7b6bfd1191959542cf554680b10e8d835a0b23af63ebeab2d135a0822a551bafca71f6bc311d905aadb08
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
120KB
-
Filesize
168KB
-
Filesize
68KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
68KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
296KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
168KB
-
Filesize
68KB
-
Filesize
296KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
68KB
-
Filesize
296KB
-
Filesize
296KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
296KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
68KB
-
Filesize
120KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
120KB
-
Filesize
168KB
-
Filesize
68KB
-
Filesize
296KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
168KB
-
Filesize
296KB
-
Filesize
68KB
-
Filesize
120KB
-
Filesize
68KB
-
Filesize
296KB
-
Filesize
168KB
-
Filesize
168KB
-
Filesize
168KB