55d317204822c20fd3c752374742378d461594f1f7af27bac06518c1e24d1f03

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5817514c2c9b6a11eaeb20dca1861360.exe
Size

266KB
MD5

5817514c2c9b6a11eaeb20dca1861360
SHA1

a7429c5378a386582b11ce5863e8c531d311d318
SHA256

55d317204822c20fd3c752374742378d461594f1f7af27bac06518c1e24d1f03
SHA512

5c399257fb930ac1b52b1e90377b2dd6a71c0546a3fae4e781ed0e3d51d7a5feff3a26e6ea15ae94cdf14977153b46e0cec497a3a344d9f630c87961a5c4693b
SSDEEP

3072:V9c0GV/ACeZbfDaLH5pl/6G8eNp2vIUZmuUxfu12KTlC4GMYNhk8tyC8/V0:xGVYvpDab5pl/58eOTZmuUxb74Z88/2

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2184	uninstall.exe

Loads dropped DLL 4 IoCs

pid	Process
1992	5817514c2c9b6a11eaeb20dca1861360.exe
2184	uninstall.exe
2184	uninstall.exe
2184	uninstall.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	5817514c2c9b6a11eaeb20dca1861360.exe
File opened for modification	\??\PhysicalDrive0	uninstall.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2184	uninstall.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1992	5817514c2c9b6a11eaeb20dca1861360.exe
2184	uninstall.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2184	1992	5817514c2c9b6a11eaeb20dca1861360.exe	28
PID 1992 wrote to memory of 2184	1992	5817514c2c9b6a11eaeb20dca1861360.exe	28
PID 1992 wrote to memory of 2184	1992	5817514c2c9b6a11eaeb20dca1861360.exe	28
PID 1992 wrote to memory of 2184	1992	5817514c2c9b6a11eaeb20dca1861360.exe	28
PID 1992 wrote to memory of 2184	1992	5817514c2c9b6a11eaeb20dca1861360.exe	28
PID 1992 wrote to memory of 2184	1992	5817514c2c9b6a11eaeb20dca1861360.exe	28
PID 1992 wrote to memory of 2184	1992	5817514c2c9b6a11eaeb20dca1861360.exe	28

C:\Users\Admin\AppData\Local\Temp\5817514c2c9b6a11eaeb20dca1861360.exe
"C:\Users\Admin\AppData\Local\Temp\5817514c2c9b6a11eaeb20dca1861360.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\uninstall.exe
  C:\Users\Admin\AppData\Local\Temp\uninstall.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\uninstall.exe

Filesize
266KB

MD5
5817514c2c9b6a11eaeb20dca1861360

SHA1
a7429c5378a386582b11ce5863e8c531d311d318

SHA256
55d317204822c20fd3c752374742378d461594f1f7af27bac06518c1e24d1f03

SHA512
5c399257fb930ac1b52b1e90377b2dd6a71c0546a3fae4e781ed0e3d51d7a5feff3a26e6ea15ae94cdf14977153b46e0cec497a3a344d9f630c87961a5c4693b

Download Submit