79dffcc76eefc63773f7715be810b62f80c2d2ad73f48977e597d4f9d7eef004

General

Target

7ba91cd985d366719cb3d000bea8a7d9.exe
Size

384KB
MD5

7ba91cd985d366719cb3d000bea8a7d9
SHA1

6c9de75acbff861b7c8c7e81f85ce389f98ae4da
SHA256

79dffcc76eefc63773f7715be810b62f80c2d2ad73f48977e597d4f9d7eef004
SHA512

9b88a5de07e99b32f90fb4cb74c87578decfd01e26d29dca0b828e21571abdabd792d4aa187307e8a80c9555a99f8b1c4eb35cdcf3640d4a14d5be622d8b8a06
SSDEEP

6144:ftXKglv+Vzs6mXauC8ISk0hXJWSdx1HXzS/Sp9UdjUEFPC:fVlv+JqxCFSPhXrSG+iEE

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	7ba91cd985d366719cb3d000bea8a7d9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2552 set thread context of 2400	2552	7ba91cd985d366719cb3d000bea8a7d9.exe	16

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	7ba91cd985d366719cb3d000bea8a7d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	7ba91cd985d366719cb3d000bea8a7d9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	7ba91cd985d366719cb3d000bea8a7d9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2400	7ba91cd985d366719cb3d000bea8a7d9.exe
2400	7ba91cd985d366719cb3d000bea8a7d9.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2552	7ba91cd985d366719cb3d000bea8a7d9.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 2400	2552	7ba91cd985d366719cb3d000bea8a7d9.exe	16
PID 2552 wrote to memory of 2400	2552	7ba91cd985d366719cb3d000bea8a7d9.exe	16
PID 2552 wrote to memory of 2400	2552	7ba91cd985d366719cb3d000bea8a7d9.exe	16
PID 2552 wrote to memory of 2400	2552	7ba91cd985d366719cb3d000bea8a7d9.exe	16
PID 2552 wrote to memory of 2400	2552	7ba91cd985d366719cb3d000bea8a7d9.exe	16
PID 2552 wrote to memory of 2400	2552	7ba91cd985d366719cb3d000bea8a7d9.exe	16
PID 2552 wrote to memory of 2400	2552	7ba91cd985d366719cb3d000bea8a7d9.exe	16
PID 2552 wrote to memory of 2400	2552	7ba91cd985d366719cb3d000bea8a7d9.exe	16
PID 2400 wrote to memory of 1380	2400	7ba91cd985d366719cb3d000bea8a7d9.exe	7
PID 2400 wrote to memory of 1380	2400	7ba91cd985d366719cb3d000bea8a7d9.exe	7
PID 2400 wrote to memory of 1380	2400	7ba91cd985d366719cb3d000bea8a7d9.exe	7
PID 2400 wrote to memory of 1380	2400	7ba91cd985d366719cb3d000bea8a7d9.exe	7

C:\Users\Admin\AppData\Local\Temp\7ba91cd985d366719cb3d000bea8a7d9.exe
"C:\Users\Admin\AppData\Local\Temp\7ba91cd985d366719cb3d000bea8a7d9.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\7ba91cd985d366719cb3d000bea8a7d9.exe
  C:\Users\Admin\AppData\Local\Temp\7ba91cd985d366719cb3d000bea8a7d9.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2400

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-26-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/1380-30-0x000000007EFD0000-0x000000007EFD1000-memory.dmp

Filesize
4KB

Download
memory/2400-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2400-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2400-25-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2400-23-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2400-40-0x0000000000400000-0x0000000000408960-memory.dmp

Filesize
34KB

Download
memory/2400-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2400-18-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2400-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2400-29-0x0000000010000000-0x0000000010013000-memory.dmp

Filesize
76KB

Download
memory/2400-11-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2552-9-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/2552-10-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/2552-8-0x0000000000680000-0x0000000000681000-memory.dmp

Filesize
4KB

Download
memory/2552-7-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/2552-5-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/2552-3-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download
memory/2552-1-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2552-12-0x0000000002AF0000-0x0000000002BF6000-memory.dmp

Filesize
1.0MB

Download
memory/2552-0-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download
memory/2552-4-0x00000000002B0000-0x00000000002C0000-memory.dmp

Filesize
64KB

Download
memory/2552-22-0x0000000000400000-0x0000000000506000-memory.dmp

Filesize
1.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads