45d4487f538c4676a22ee12edb575012740fbaa1395efa4cc6319c8796e1f61f

General

Target

1b31ff9e48880dcb6e186bb23c8cd2a7.exe
Size

469KB
MD5

1b31ff9e48880dcb6e186bb23c8cd2a7
SHA1

0b542a53b64c754e2daef53195e51a6acfa9844c
SHA256

45d4487f538c4676a22ee12edb575012740fbaa1395efa4cc6319c8796e1f61f
SHA512

d8e96e02273f64ef4348e3e1370c94f0183853aed65d7dfbce2d6786241eed9dfac79a3dbbd5582d1432c0da0bba6ce92448f2ac97cb9fad53bcfcc8a93dec48
SSDEEP

12288:Wb7jkD3v0VBRxE5MBGlcM7UdrAs7UZWG1j3FLiUh:Wb3w3v8BRqEM7UdtU1j35i

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2812	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2440	Internet Explorer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	1b31ff9e48880dcb6e186bb23c8cd2a7.exe
File opened for modification	\??\PhysicalDrive0	Internet Explorer.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Internet Explorer.exe	1b31ff9e48880dcb6e186bb23c8cd2a7.exe
File opened for modification	C:\Windows\Internet Explorer.exe	1b31ff9e48880dcb6e186bb23c8cd2a7.exe
File created	C:\Windows\HKFX2008.BAT	1b31ff9e48880dcb6e186bb23c8cd2a7.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	1b31ff9e48880dcb6e186bb23c8cd2a7.exe
Token: SeDebugPrivilege	2440	Internet Explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2440	Internet Explorer.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2808	2440	Internet Explorer.exe	29
PID 2440 wrote to memory of 2808	2440	Internet Explorer.exe	29
PID 2440 wrote to memory of 2808	2440	Internet Explorer.exe	29
PID 2440 wrote to memory of 2808	2440	Internet Explorer.exe	29
PID 2644 wrote to memory of 2812	2644	1b31ff9e48880dcb6e186bb23c8cd2a7.exe	30
PID 2644 wrote to memory of 2812	2644	1b31ff9e48880dcb6e186bb23c8cd2a7.exe	30
PID 2644 wrote to memory of 2812	2644	1b31ff9e48880dcb6e186bb23c8cd2a7.exe	30
PID 2644 wrote to memory of 2812	2644	1b31ff9e48880dcb6e186bb23c8cd2a7.exe	30

C:\Users\Admin\AppData\Local\Temp\1b31ff9e48880dcb6e186bb23c8cd2a7.exe
"C:\Users\Admin\AppData\Local\Temp\1b31ff9e48880dcb6e186bb23c8cd2a7.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\HKFX2008.BAT
  2⤵
  - Deletes itself
  PID:2812

C:\Windows\Internet Explorer.exe
"C:\Windows\Internet Explorer.exe"
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\HKFX2008.BAT

Filesize
190B

MD5
7e8a42f96e1f2ee8c17c0ff1f12fc417

SHA1
11f223d139efdbee3a4fd9511ab67e243e3a1db1

SHA256
c6430b8da214ec12b709a14eeb4558d4d88e1539689993fb9924caa90d3ee810

SHA512
b82af9b0ca153287cbb9bfd6757ae067bc684256d6a41743699431ac2883d690fac8ffe59516db4a9156b1796190ce132b6d758754ff4155907b6b224e92fc1e

Download Submit
C:\Windows\Internet Explorer.exe

Filesize
469KB

MD5
1b31ff9e48880dcb6e186bb23c8cd2a7

SHA1
0b542a53b64c754e2daef53195e51a6acfa9844c

SHA256
45d4487f538c4676a22ee12edb575012740fbaa1395efa4cc6319c8796e1f61f

SHA512
d8e96e02273f64ef4348e3e1370c94f0183853aed65d7dfbce2d6786241eed9dfac79a3dbbd5582d1432c0da0bba6ce92448f2ac97cb9fad53bcfcc8a93dec48

Download Submit
memory/2440-28-0x0000000000520000-0x0000000000521000-memory.dmp

Filesize
4KB

Download
memory/2440-31-0x00000000005B0000-0x00000000005B1000-memory.dmp

Filesize
4KB

Download
memory/2440-30-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2440-29-0x0000000000560000-0x0000000000561000-memory.dmp

Filesize
4KB

Download
memory/2440-32-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download
memory/2440-27-0x0000000001E40000-0x0000000001E41000-memory.dmp

Filesize
4KB

Download
memory/2440-26-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/2440-25-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2440-24-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2440-23-0x0000000000340000-0x000000000037A000-memory.dmp

Filesize
232KB

Download
memory/2440-22-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2644-12-0x0000000001EB0000-0x0000000001EB1000-memory.dmp

Filesize
4KB

Download
memory/2644-0-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2644-5-0x0000000001E20000-0x0000000001E21000-memory.dmp

Filesize
4KB

Download
memory/2644-19-0x0000000001E30000-0x0000000001E31000-memory.dmp

Filesize
4KB

Download
memory/2644-16-0x0000000001E40000-0x0000000001E41000-memory.dmp

Filesize
4KB

Download
memory/2644-20-0x0000000001EF0000-0x0000000001EF1000-memory.dmp

Filesize
4KB

Download
memory/2644-7-0x0000000001F10000-0x0000000001F11000-memory.dmp

Filesize
4KB

Download
memory/2644-8-0x0000000002380000-0x0000000002381000-memory.dmp

Filesize
4KB

Download
memory/2644-9-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/2644-10-0x0000000001E90000-0x0000000001E91000-memory.dmp

Filesize
4KB

Download
memory/2644-11-0x0000000001ED0000-0x0000000001ED1000-memory.dmp

Filesize
4KB

Download
memory/2644-6-0x0000000001F00000-0x0000000001F01000-memory.dmp

Filesize
4KB

Download
memory/2644-15-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

Filesize
4KB

Download
memory/2644-13-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/2644-14-0x0000000001F30000-0x0000000001F31000-memory.dmp

Filesize
4KB

Download
memory/2644-4-0x0000000001DF0000-0x0000000001DF1000-memory.dmp

Filesize
4KB

Download
memory/2644-3-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2644-2-0x0000000001DD0000-0x0000000001DD1000-memory.dmp

Filesize
4KB

Download
memory/2644-41-0x0000000000400000-0x00000000004E4000-memory.dmp

Filesize
912KB

Download
memory/2644-1-0x00000000004F0000-0x000000000052A000-memory.dmp

Filesize
232KB

Download
memory/2644-42-0x00000000004F0000-0x000000000052A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads