417947f3a7839131efb296281c30bd57ce2533bf97ae35dfdaeeb49f7d8b1e8d

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1bce520ca9d835b7757058505493c49.exe
Size

252KB
MD5

a1bce520ca9d835b7757058505493c49
SHA1

ac563570847617f7f68d1142c2b30c4455261c12
SHA256

417947f3a7839131efb296281c30bd57ce2533bf97ae35dfdaeeb49f7d8b1e8d
SHA512

fe9fc691a7dce53067556c173d9d599d86e882f90661e55e25aca08b92da64bdca51c84da4af9e4ba4bea66e2733e19eba9a89ba744626684fe91419a9b41494
SSDEEP

6144:VlzknoBcRzrWsJywvP6bQ7yMP+DE827OaFSEpAX:nAnZRzJT6b7MP+Dd2iafpAX

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	a1bce520ca9d835b7757058505493c49.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\inf\ram32xp.dll	a1bce520ca9d835b7757058505493c49.exe
File created	C:\Windows\inf\ram65xp.dll	a1bce520ca9d835b7757058505493c49.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	a1bce520ca9d835b7757058505493c49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	a1bce520ca9d835b7757058505493c49.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	a1bce520ca9d835b7757058505493c49.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1972	2992	a1bce520ca9d835b7757058505493c49.exe	28
PID 2992 wrote to memory of 1972	2992	a1bce520ca9d835b7757058505493c49.exe	28
PID 2992 wrote to memory of 1972	2992	a1bce520ca9d835b7757058505493c49.exe	28
PID 2992 wrote to memory of 1972	2992	a1bce520ca9d835b7757058505493c49.exe	28
PID 2992 wrote to memory of 1972	2992	a1bce520ca9d835b7757058505493c49.exe	28
PID 2992 wrote to memory of 1972	2992	a1bce520ca9d835b7757058505493c49.exe	28
PID 2992 wrote to memory of 1972	2992	a1bce520ca9d835b7757058505493c49.exe	28
PID 2556 wrote to memory of 2680	2556	explorer.exe	30
PID 2556 wrote to memory of 2680	2556	explorer.exe	30
PID 2556 wrote to memory of 2680	2556	explorer.exe	30
PID 2556 wrote to memory of 2680	2556	explorer.exe	30

C:\Users\Admin\AppData\Local\Temp\a1bce520ca9d835b7757058505493c49.exe
"C:\Users\Admin\AppData\Local\Temp\a1bce520ca9d835b7757058505493c49.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\explorer.exe
  explorer.exe "c:\FINAL_TBF2.pdf"
  2⤵
  PID:1972

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\FINAL_TBF2.pdf"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0e200274f22535082b337024ce3dd8b5

SHA1
3a8447647896aa7e7eeed14877ab622be870824f

SHA256
35ae12451139c26ff066b424a8d5b27a448fcd67bb4a56abad019db74001a125

SHA512
4f941adba3ddb9365099ebf5a61f0f65031bd5f2a8e39f00b735caad9f862c204552596708563fea85e3b2124b7f45e5625d9238a474805504b327543b7989b7

Download Submit
memory/2992-0-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2992-6-0x0000000000280000-0x00000000002B0000-memory.dmp

Filesize
192KB

Download
memory/2992-5-0x0000000000270000-0x0000000000277000-memory.dmp

Filesize
28KB

Download
memory/2992-4-0x00000000002B0000-0x00000000002B2000-memory.dmp

Filesize
8KB

Download
memory/2992-3-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download
memory/2992-1-0x0000000000230000-0x00000000002AA000-memory.dmp

Filesize
488KB

Download
memory/2992-7-0x0000000000400000-0x000000000047A000-memory.dmp

Filesize
488KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads