9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe
Size

4.8MB
MD5

3ed349d604b0081a01c1931862395414
SHA1

475716d9000b92624c19dcb54f96e8fef270482b
SHA256

9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc
SHA512

90dbb5bffe7dd35fe7dcbefe3735679740b12a0e1f9a171da17b7b01373ed9bd04d83b607bfcaf321ded008f0f2fbcb5e8d45afb830d93a257d9b9ee2f5a29d7
SSDEEP

98304:nXHfZysNkdeOVWB4PGrx2fEyMmzHJhYlRJM:nPx1dx2f9MmzHwY

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2064	9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe
2064	9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LuDaShi\{E714D66E-00DE-49db-91E2-BDD70BC0707A}.tf	9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe
File created	C:\Program Files (x86)\LuDaShi\{15846901-6564-42b1-BF0C-7F390B7EFA25}.tmp\{9D1AC878-8280-43b3-8584-510F90C315FD}.tf	9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2696	2064	WerFault.exe	27

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2696	2064	9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe	28
PID 2064 wrote to memory of 2696	2064	9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe	28
PID 2064 wrote to memory of 2696	2064	9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe	28
PID 2064 wrote to memory of 2696	2064	9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe	28

C:\Users\Admin\AppData\Local\Temp\9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe
"C:\Users\Admin\AppData\Local\Temp\9a76684fd59177b6b577c42893f6347f2df55fae48e478a8c68c92fba7f139dc.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 868
  2⤵
  - Program crash
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\{7BAF0064-E218-45d5-BC90-3A790EA4A57D}.tmp\NetBridge.dll

Filesize
231KB

MD5
9d145902fb5b9a6da62ac85761434e31

SHA1
c817d77f59e3767d75cf5f5298d6b5711308f7e5

SHA256
98d795d55329b1057f4fd590468e648a8c34b620207fd9a0a6953f3e98d1ea43

SHA512
bbb3109bcd5ded909bfdaeb7f4f006fc5928a9bc501bad5ae8ba9805bc0d924a2c4da8bbd215480db936d663852abd9b0435fa241a40224a4cd93c4b7aff79a9

Download Submit
\Users\Admin\AppData\Local\Temp\{A463712B-41A9-4e26-A905-A261F475B8AF}.tmp\7z.dll

Filesize
1021KB

MD5
97b3f9a2e27a3a7385e10caca73d53f1

SHA1
1a0f81c2d86de78e08980e579a11f0481774d52a

SHA256
df6645149c57dbf42cadb7130addab9a6b515cf25dfb42c4f5b740466edb2b8a

SHA512
afc82426320107196149ef362e53939cf6f40c0d0793884c638c39b9a5c1fe54bd4196f6fc3ac4b2c87a67f8a2552226eeb48860f466115903c52daaebbc7584

Download Submit
memory/2064-27-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads