f0f2fb71837a793c208c89d81c3861fc7f729840aaf1a45df04d95a102e3994b

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

03bf519c153a24712b21383fb0b8919d.exe
Size

250KB
MD5

03bf519c153a24712b21383fb0b8919d
SHA1

fae3ae91bd0fabc662c55b685b14ccc030e1df13
SHA256

f0f2fb71837a793c208c89d81c3861fc7f729840aaf1a45df04d95a102e3994b
SHA512

142148ff7464de056d3629e1293dece638e39747154cf82685e08619f9b569638622b236ae95f50d7d95d9b75858964f28a525274b9f32b8de9ccd73c0cbcd8a
SSDEEP

6144:j7y+Qfb56BBMl5yyw5CpA/7sJ5pwvP6bQ7yMP+DE827KJH:/yf6aw5krJ5i6b7MP+Dd2K

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	03bf519c153a24712b21383fb0b8919d.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\inf\ram32xp.dll	03bf519c153a24712b21383fb0b8919d.exe
File created	C:\Windows\inf\ram65xp.dll	03bf519c153a24712b21383fb0b8919d.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	03bf519c153a24712b21383fb0b8919d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	03bf519c153a24712b21383fb0b8919d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	03bf519c153a24712b21383fb0b8919d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2576	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2576	AcroRd32.exe
2576	AcroRd32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2996	2964	03bf519c153a24712b21383fb0b8919d.exe	28
PID 2964 wrote to memory of 2996	2964	03bf519c153a24712b21383fb0b8919d.exe	28
PID 2964 wrote to memory of 2996	2964	03bf519c153a24712b21383fb0b8919d.exe	28
PID 2964 wrote to memory of 2996	2964	03bf519c153a24712b21383fb0b8919d.exe	28
PID 2964 wrote to memory of 2996	2964	03bf519c153a24712b21383fb0b8919d.exe	28
PID 2964 wrote to memory of 2996	2964	03bf519c153a24712b21383fb0b8919d.exe	28
PID 2964 wrote to memory of 2996	2964	03bf519c153a24712b21383fb0b8919d.exe	28
PID 2036 wrote to memory of 2576	2036	explorer.exe	29
PID 2036 wrote to memory of 2576	2036	explorer.exe	29
PID 2036 wrote to memory of 2576	2036	explorer.exe	29
PID 2036 wrote to memory of 2576	2036	explorer.exe	29

C:\Users\Admin\AppData\Local\Temp\03bf519c153a24712b21383fb0b8919d.exe
"C:\Users\Admin\AppData\Local\Temp\03bf519c153a24712b21383fb0b8919d.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe "c:\FINAL_TBF2.pdf"
  2⤵
  PID:2996

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\FINAL_TBF2.pdf"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2576

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
18b0886eabc4747a91ca73afee671cc3

SHA1
7c498c9617e1ac8d513cbb5827aa1c3d63cd5f27

SHA256
67607cc0efb49da3577fb40dba95b75f409da3d559e75f42996604eb6954f9d1

SHA512
9aabab813ec649e9de93dcec3b22a7bc8d41fbfd465d159860c2189e6083e6aac65d788a8e5e422c8464733815a25085b91d3afb334d60a4799888990e56c68a

Download Submit
memory/2964-0-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2964-2-0x00000000008D0000-0x0000000000949000-memory.dmp

Filesize
484KB

Download
memory/2964-3-0x0000000000610000-0x0000000000640000-memory.dmp

Filesize
192KB

Download
memory/2964-1-0x00000000008D0000-0x0000000000949000-memory.dmp

Filesize
484KB

Download
memory/2964-6-0x0000000001DD0000-0x0000000001DD2000-memory.dmp

Filesize
8KB

Download
memory/2964-5-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2964-4-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download
memory/2964-9-0x0000000000610000-0x0000000000640000-memory.dmp

Filesize
192KB

Download
memory/2964-8-0x0000000000400000-0x0000000000479000-memory.dmp

Filesize
484KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads