Analysis

  • max time kernel
    150s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    16-02-2024 04:33

General

  • Target

    9f73e803223c0bf72ad91341d8f4c24d.exe

  • Size

    1.1MB

  • MD5

    9f73e803223c0bf72ad91341d8f4c24d

  • SHA1

    3a11680d0969423ab5f63e104c65cf0fc88901b8

  • SHA256

    47762ead584529301063c560e505998a8a5a50749cd34c6313a90ae69b58d1c5

  • SHA512

    c190aec73a8c1e15b044c6867a32a78955393d5e69002fa478c0772d148f8275348a32f2088dde71d90d8193634bba132b84b070615e8b1d663a08094376d2dd

  • SSDEEP

    24576:QU1uUHG/7vZKGVlfumMH8NS59MQ4CwNOt7X6r0gRf45PqCCF:f13Ahrb2Lcg59f4VNOtLk0x5PqtF

Score
8/10

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 4 IoCs
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1260
      • C:\Users\Admin\AppData\Local\Temp\9f73e803223c0bf72ad91341d8f4c24d.exe
        "C:\Users\Admin\AppData\Local\Temp\9f73e803223c0bf72ad91341d8f4c24d.exe"
        2⤵
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2472
        • C:\Users\Admin\AppData\Local\Temp\9f73e803223c0bf72ad91341d8f4c24d.exe
          C:\Users\Admin\AppData\Local\Temp\9f73e803223c0bf72ad91341d8f4c24d.exe
          3⤵
          • Adds policy Run key to start application
          • Modifies Installed Components in the registry
          • Adds Run key to start application
          • Drops file in System32 directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2608
          • C:\Windows\SysWOW64\explorer.exe
            explorer.exe
            4⤵
              PID:2880

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2472-19-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-29-0x0000000000230000-0x0000000000231000-memory.dmp

        Filesize

        4KB

      • memory/2472-2-0x0000000000400000-0x000000000047B000-memory.dmp

        Filesize

        492KB

      • memory/2472-0-0x0000000000400000-0x000000000047B000-memory.dmp

        Filesize

        492KB

      • memory/2472-6-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-4-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-7-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-8-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-9-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-10-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-11-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-12-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-14-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-13-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-16-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-15-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-18-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-17-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-3-0x00000000003E0000-0x00000000003E3000-memory.dmp

        Filesize

        12KB

      • memory/2472-21-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-23-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-20-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-22-0x00000000004B0000-0x00000000004B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-24-0x0000000000240000-0x0000000000250000-memory.dmp

        Filesize

        64KB

      • memory/2472-25-0x00000000003D0000-0x00000000003D1000-memory.dmp

        Filesize

        4KB

      • memory/2472-28-0x0000000000220000-0x0000000000221000-memory.dmp

        Filesize

        4KB

      • memory/2472-27-0x00000000003F0000-0x00000000003F1000-memory.dmp

        Filesize

        4KB

      • memory/2472-30-0x0000000000480000-0x0000000000481000-memory.dmp

        Filesize

        4KB

      • memory/2472-1-0x0000000000400000-0x000000000047B000-memory.dmp

        Filesize

        492KB

      • memory/2472-31-0x00000000002A0000-0x00000000002A1000-memory.dmp

        Filesize

        4KB

      • memory/2472-32-0x0000000000250000-0x0000000000251000-memory.dmp

        Filesize

        4KB

      • memory/2472-37-0x0000000000400000-0x000000000047B000-memory.dmp

        Filesize

        492KB

      • memory/2472-34-0x00000000002B0000-0x00000000002B1000-memory.dmp

        Filesize

        4KB

      • memory/2472-33-0x00000000002D0000-0x00000000002D1000-memory.dmp

        Filesize

        4KB

      • memory/2608-35-0x0000000000400000-0x00000000004FA000-memory.dmp

        Filesize

        1000KB

      • memory/2608-36-0x0000000000400000-0x00000000004FA000-memory.dmp

        Filesize

        1000KB

      • memory/2608-38-0x0000000000400000-0x00000000004FA000-memory.dmp

        Filesize

        1000KB