23d4090c88b0c9074172f54a87612128c810397cc597b3271338b251c9b823aa

Analysis

max time kernel
118s
max time network
147s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/12/2023, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f773982cef72835130e81225f18d89ee.exe
Size

1.7MB
MD5

f773982cef72835130e81225f18d89ee
SHA1

7f449fa0b72b402401e45caea810cef5d01396e9
SHA256

23d4090c88b0c9074172f54a87612128c810397cc597b3271338b251c9b823aa
SHA512

c75051b1450eff66aaa26c8056756bc09bdf73bd56fbd49c4c0843bb0a36eb13d7af5472cde75e43436fb5e05b80dd29e8dae0c135347d418fce32d619959a36
SSDEEP

49152:QnSrJNWGDcKc5TLRYjur81bo7CWvGK7N+9Vhg:ZJEakVYjM8LWvGKh+9jg

Score

7^/10

bootkit persistence

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2032	f773982cef72835130e81225f18d89ee.exe
2032	f773982cef72835130e81225f18d89ee.exe
2032	f773982cef72835130e81225f18d89ee.exe
2032	f773982cef72835130e81225f18d89ee.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	f773982cef72835130e81225f18d89ee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid	f773982cef72835130e81225f18d89ee.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd	f773982cef72835130e81225f18d89ee.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\metnsd\clsid\SequenceID = 5075c681648140419af38e1986279fb8	f773982cef72835130e81225f18d89ee.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2032	f773982cef72835130e81225f18d89ee.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2032	f773982cef72835130e81225f18d89ee.exe

C:\Users\Admin\AppData\Local\Temp\f773982cef72835130e81225f18d89ee.exe
"C:\Users\Admin\AppData\Local\Temp\f773982cef72835130e81225f18d89ee.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsy1C2A.tmp\tmpbjdpuf.dll

Filesize
656KB

MD5
4089e818ee4cfca5f36f56693503044e

SHA1
b3dc6e3754acde3cf7566236fda97b11d5d6c115

SHA256
488ae57ca687beee4f718db107cd9df99b75915ca9e436d5468a8a137671ef49

SHA512
8bf46f8e65092e32ac835a692d235aaba03e84e0e2a8662c504e27eb51a32deb3597e74b12d4fde13f3f1086acf208d0143d028a47768e6145e2b5e7d6c435a0

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1C2A.tmp\BDMDownload.dll

Filesize
158KB

MD5
3ea3afc6800846dec75863cd18954236

SHA1
30918c407a6dce99145f776c5cd7c7ef709f877c

SHA256
621936a505b52c1889798675b4ae912fd2857ee91fcbd71987319fc20b8691c7

SHA512
d8cd1add835a3a151edbb81d67c4a1733592230bce35ca938f0be23e9d3dbcbd4f27db41287cf9bc6fe401a5d19076be3773006857fd6175d8dbb0008c298807

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1C2A.tmp\BDMSkin.dll

Filesize
1.3MB

MD5
b540a866191f7fd20f5e6355bc2b094e

SHA1
df01a0c011e88a1f860db41d474d3fe893f06082

SHA256
ce3044e92a827fce76a75dbd817545506dcab76a5f4edac3c9cf37236a1eecb6

SHA512
e65aa73a9e8118176f294edeb7a9dc3a71319b218a45de6073622b868bee2fab9d7b6f76577f846cc940b4b949ee0110fbb449df3d77c922464cf6ded1408331

Download Submit
\Users\Admin\AppData\Local\Temp\nsy1C2A.tmp\dl.dll

Filesize
1.9MB

MD5
763b532d651f0ad5e135d9b57bf4fba4

SHA1
23f1302f904a67a1fe0d48e11a435c2f36336196

SHA256
50b3c45ede6fd2d77c4f040242b2174289767b18a3a084e7046133b05f93e173

SHA512
a4ec0f5bfa30d3558935f4075a75aebf080ece324a550c573d8a424730693b030cd26b4862973e8da8937e610c287d64e96c2fd952b59324ed1822919a00737c

Download Submit
memory/2032-12-0x00000000029F0000-0x0000000002B33000-memory.dmp

Filesize
1.3MB

Download
memory/2032-29-0x0000000005520000-0x000000000570D000-memory.dmp

Filesize
1.9MB

Download
memory/2032-24-0x0000000002D20000-0x0000000002D48000-memory.dmp

Filesize
160KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads