e1b1263319cf49f75bf91965d0a26dd14aa78099b3acc4a0481c1082455d15b4

Analysis

max time kernel
131s
max time network
141s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 20:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dfc8c3e6f3bb0bf9769fd8b295f518a.exe
Size

152KB
MD5

7dfc8c3e6f3bb0bf9769fd8b295f518a
SHA1

b9bea0cd567d4643de1dc9346cfefa53153e4f56
SHA256

e1b1263319cf49f75bf91965d0a26dd14aa78099b3acc4a0481c1082455d15b4
SHA512

b16c265532bdbf52fb18cad7172ca0e544bc923d1689ccc171d67bc8db2c6244c96b23d064d3743951bbde36ac6249bd10c8db0c29511db97816931b2927343d
SSDEEP

3072:1g+jB7s2eCUaFPmgRMNlPTGQQm6ytwZEsrYkK4Yg:1rjBbeC98gWNlPTGQQm6agrd

Score

7^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1876	haZl0oh.exe
2340	haZl0oh.exe

Loads dropped DLL 2 IoCs

pid	Process
2544	7dfc8c3e6f3bb0bf9769fd8b295f518a.exe
2544	7dfc8c3e6f3bb0bf9769fd8b295f518a.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	7dfc8c3e6f3bb0bf9769fd8b295f518a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\haZl0oh.exe	haZl0oh.exe
File opened for modification	C:\Windows\SysWOW64\haZl0oh.exe	haZl0oh.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1876	haZl0oh.exe
1876	haZl0oh.exe
1876	haZl0oh.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1876	haZl0oh.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1876	2544	7dfc8c3e6f3bb0bf9769fd8b295f518a.exe	28
PID 2544 wrote to memory of 1876	2544	7dfc8c3e6f3bb0bf9769fd8b295f518a.exe	28
PID 2544 wrote to memory of 1876	2544	7dfc8c3e6f3bb0bf9769fd8b295f518a.exe	28
PID 2544 wrote to memory of 1876	2544	7dfc8c3e6f3bb0bf9769fd8b295f518a.exe	28
PID 1876 wrote to memory of 1960	1876	haZl0oh.exe	29
PID 1876 wrote to memory of 1960	1876	haZl0oh.exe	29
PID 1876 wrote to memory of 1960	1876	haZl0oh.exe	29
PID 1876 wrote to memory of 1960	1876	haZl0oh.exe	29

C:\Users\Admin\AppData\Local\Temp\7dfc8c3e6f3bb0bf9769fd8b295f518a.exe
"C:\Users\Admin\AppData\Local\Temp\7dfc8c3e6f3bb0bf9769fd8b295f518a.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\haZl0oh.exe
  haZl0oh.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\haZl0oh.exe > nul
    3⤵
    PID:1960

C:\Windows\SysWOW64\haZl0oh.exe
C:\Windows\SysWOW64\haZl0oh.exe
1⤵
- Executes dropped EXE
PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\haZl0oh.exe

Filesize
18KB

MD5
0fb956b0b5796455b979144d1a3c55ac

SHA1
b3abbb5eb5401bb2be7c9a5584a43f62b8ca327f

SHA256
06e5edf3107e6c5542a7ae8cb71732387e52dd581904a13a2796bed9d19de186

SHA512
b15e41b2ae9ca769aefd6620f3b3e19617f444c2c10a211888f9ad1cdf572633c53c88698aefb18cdccbe8322428d59fa997eff31f09a1b1befc8b0c55288781

Download Submit
memory/2544-7-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2544-4-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2544-12-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download
memory/2544-11-0x0000000000540000-0x0000000000541000-memory.dmp

Filesize
4KB

Download
memory/2544-10-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2544-9-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2544-13-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2544-6-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/2544-8-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2544-5-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/2544-1-0x0000000000270000-0x00000000002B3000-memory.dmp

Filesize
268KB

Download
memory/2544-2-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2544-0-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2544-24-0x0000000000400000-0x0000000000436000-memory.dmp

Filesize
216KB

Download
memory/2544-25-0x0000000000270000-0x00000000002B3000-memory.dmp

Filesize
268KB

Download