448cd0fee889c5fe4a0fc20351eb033b345bb0e557d22251cca2cf881d2ce885

Analysis

max time kernel
151s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 02:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b04effb568f5aa8b85e19c19033f5f6.exe
Size

466KB
MD5

0b04effb568f5aa8b85e19c19033f5f6
SHA1

70a66fdb5e88becd5c93e154c6388d5de92fcc41
SHA256

448cd0fee889c5fe4a0fc20351eb033b345bb0e557d22251cca2cf881d2ce885
SHA512

22481999a5b07161240b03fb5826297b0dedb26260a52d15f634521a153d5dda1106c34cf18192f27d57591b8c4736f61311a5b267ea20e6610600d7885eb532
SSDEEP

12288:gBSKHQxVQdLWIPwuZS3+mGExxGetNtTirdKozH5:g4QsI4uAOexxG+TEdKc

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2760	SYSTEM.ini

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	0b04effb568f5aa8b85e19c19033f5f6.exe
File opened for modification	\??\PhysicalDrive0	SYSTEM.ini

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	SYSTEM.ini

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SYSTEM.ini	0b04effb568f5aa8b85e19c19033f5f6.exe
File created	C:\Windows\SYSTEM.ini	0b04effb568f5aa8b85e19c19033f5f6.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	SYSTEM.ini
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D015D2FA-44C1-4AB5-B740-15774B55567F}\52-0e-10-bb-4b-f0	SYSTEM.ini
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-0e-10-bb-4b-f0\WpadDecisionTime = e09aa4b9b93bda01	SYSTEM.ini
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SYSTEM.ini
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D015D2FA-44C1-4AB5-B740-15774B55567F}\WpadNetworkName = "Network 3"	SYSTEM.ini
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	SYSTEM.ini
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D015D2FA-44C1-4AB5-B740-15774B55567F}\WpadDecisionReason = "1"	SYSTEM.ini
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D015D2FA-44C1-4AB5-B740-15774B55567F}\WpadDecision = "0"	SYSTEM.ini
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SYSTEM.ini
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D015D2FA-44C1-4AB5-B740-15774B55567F}\WpadDecisionTime = a0456fedb93bda01	SYSTEM.ini
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-0e-10-bb-4b-f0\WpadDecisionTime = a0456fedb93bda01	SYSTEM.ini
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SYSTEM.ini
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	SYSTEM.ini
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SYSTEM.ini
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-0e-10-bb-4b-f0\WpadDecision = "0"	SYSTEM.ini
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	SYSTEM.ini
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-0e-10-bb-4b-f0	SYSTEM.ini
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SYSTEM.ini
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	SYSTEM.ini
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D015D2FA-44C1-4AB5-B740-15774B55567F}	SYSTEM.ini
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	SYSTEM.ini
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	SYSTEM.ini
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-0e-10-bb-4b-f0\WpadDecisionReason = "1"	SYSTEM.ini
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D015D2FA-44C1-4AB5-B740-15774B55567F}\WpadDecisionTime = e09aa4b9b93bda01	SYSTEM.ini
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	SYSTEM.ini
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00b2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	SYSTEM.ini
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SYSTEM.ini
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-0e-10-bb-4b-f0\WpadDetectedUrl	SYSTEM.ini

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	0b04effb568f5aa8b85e19c19033f5f6.exe
Token: SeDebugPrivilege	2760	SYSTEM.ini

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	SYSTEM.ini

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 520	2760	SYSTEM.ini	29
PID 2760 wrote to memory of 520	2760	SYSTEM.ini	29
PID 2760 wrote to memory of 520	2760	SYSTEM.ini	29
PID 2760 wrote to memory of 520	2760	SYSTEM.ini	29

C:\Users\Admin\AppData\Local\Temp\0b04effb568f5aa8b85e19c19033f5f6.exe
"C:\Users\Admin\AppData\Local\Temp\0b04effb568f5aa8b85e19c19033f5f6.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\SYSTEM.ini
C:\Windows\SYSTEM.ini
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SYSTEM.ini

Filesize
466KB

MD5
0b04effb568f5aa8b85e19c19033f5f6

SHA1
70a66fdb5e88becd5c93e154c6388d5de92fcc41

SHA256
448cd0fee889c5fe4a0fc20351eb033b345bb0e557d22251cca2cf881d2ce885

SHA512
22481999a5b07161240b03fb5826297b0dedb26260a52d15f634521a153d5dda1106c34cf18192f27d57591b8c4736f61311a5b267ea20e6610600d7885eb532

Download Submit
memory/3056-0-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download
memory/3056-2-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/3056-22-0x00000000023B0000-0x00000000023B1000-memory.dmp

Filesize
4KB

Download
memory/3056-56-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/3056-57-0x0000000002670000-0x0000000002671000-memory.dmp

Filesize
4KB

Download
memory/3056-63-0x00000000031D0000-0x00000000031D1000-memory.dmp

Filesize
4KB

Download
memory/3056-62-0x00000000031E0000-0x00000000031E1000-memory.dmp

Filesize
4KB

Download
memory/3056-61-0x00000000031B0000-0x00000000031B1000-memory.dmp

Filesize
4KB

Download
memory/3056-60-0x00000000031C0000-0x00000000031C1000-memory.dmp

Filesize
4KB

Download
memory/3056-59-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/3056-58-0x0000000002830000-0x0000000002831000-memory.dmp

Filesize
4KB

Download
memory/3056-55-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/3056-54-0x00000000026C0000-0x00000000026C1000-memory.dmp

Filesize
4KB

Download
memory/3056-53-0x00000000026D0000-0x00000000026D1000-memory.dmp

Filesize
4KB

Download
memory/3056-52-0x00000000026A0000-0x00000000026A1000-memory.dmp

Filesize
4KB

Download
memory/3056-51-0x00000000026B0000-0x00000000026B1000-memory.dmp

Filesize
4KB

Download
memory/3056-50-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/3056-49-0x0000000002690000-0x0000000002691000-memory.dmp

Filesize
4KB

Download
memory/3056-48-0x0000000002660000-0x0000000002661000-memory.dmp

Filesize
4KB

Download
memory/3056-47-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/3056-46-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/3056-45-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/3056-44-0x0000000002600000-0x0000000002601000-memory.dmp

Filesize
4KB

Download
memory/3056-43-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/3056-42-0x00000000025F0000-0x00000000025F1000-memory.dmp

Filesize
4KB

Download
memory/3056-41-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/3056-40-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/3056-39-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/3056-38-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/3056-37-0x0000000002580000-0x0000000002581000-memory.dmp

Filesize
4KB

Download
memory/3056-36-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/3056-35-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/3056-34-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/3056-33-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/3056-32-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/3056-31-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/3056-30-0x0000000002430000-0x0000000002431000-memory.dmp

Filesize
4KB

Download
memory/3056-29-0x0000000002400000-0x0000000002401000-memory.dmp

Filesize
4KB

Download
memory/3056-28-0x0000000002410000-0x0000000002411000-memory.dmp

Filesize
4KB

Download
memory/3056-27-0x00000000023E0000-0x00000000023E1000-memory.dmp

Filesize
4KB

Download
memory/3056-26-0x00000000023F0000-0x00000000023F1000-memory.dmp

Filesize
4KB

Download
memory/3056-25-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/3056-24-0x00000000023D0000-0x00000000023D1000-memory.dmp

Filesize
4KB

Download
memory/3056-23-0x00000000023A0000-0x00000000023A1000-memory.dmp

Filesize
4KB

Download
memory/3056-21-0x0000000002070000-0x0000000002071000-memory.dmp

Filesize
4KB

Download
memory/3056-20-0x0000000002080000-0x0000000002081000-memory.dmp

Filesize
4KB

Download
memory/3056-19-0x0000000002050000-0x0000000002051000-memory.dmp

Filesize
4KB

Download
memory/3056-18-0x0000000002060000-0x0000000002061000-memory.dmp

Filesize
4KB

Download
memory/3056-17-0x0000000001FF0000-0x0000000001FF1000-memory.dmp

Filesize
4KB

Download
memory/3056-16-0x0000000002000000-0x0000000002001000-memory.dmp

Filesize
4KB

Download
memory/3056-15-0x0000000001FA0000-0x0000000001FA1000-memory.dmp

Filesize
4KB

Download
memory/3056-14-0x0000000001FD0000-0x0000000001FD1000-memory.dmp

Filesize
4KB

Download
memory/3056-13-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/3056-12-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/3056-11-0x00000000007E0000-0x00000000007E1000-memory.dmp

Filesize
4KB

Download
memory/3056-10-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/3056-9-0x0000000001F40000-0x0000000001F41000-memory.dmp

Filesize
4KB

Download
memory/3056-8-0x0000000001FC0000-0x0000000001FC1000-memory.dmp

Filesize
4KB

Download
memory/3056-7-0x0000000001FB0000-0x0000000001FB1000-memory.dmp

Filesize
4KB

Download
memory/3056-6-0x0000000001F20000-0x0000000001F26000-memory.dmp

Filesize
24KB

Download
memory/3056-5-0x0000000001F30000-0x0000000001F33000-memory.dmp

Filesize
12KB

Download
memory/3056-4-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/3056-3-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/3056-1-0x0000000000330000-0x0000000000373000-memory.dmp

Filesize
268KB

Download
memory/3056-99-0x0000000000400000-0x00000000004EF000-memory.dmp

Filesize
956KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads