f37e231d9fca43ebf0745a01769cedd64f9df3d0c8c50cdce8c6cd535a0e4482

General

Target

b7e527e572d6abb99dd0a02820828d29.exe
Size

352KB
MD5

b7e527e572d6abb99dd0a02820828d29
SHA1

5b6d1da284a9446338a8e0252d4c6aaed7da6f98
SHA256

f37e231d9fca43ebf0745a01769cedd64f9df3d0c8c50cdce8c6cd535a0e4482
SHA512

ec71163fb3956f9681a27f4c4495239f265a2741773f06de653ec676d5bf414543da2d8d6daade4a9f00db82967714e06be3e8925d1363c5af91f19eb61fb03f
SSDEEP

6144:pMK5fKXKtphMsIs3msTiHe10ceqKMLGbpzhvUZi98gWNlPTGQQm6agrd:pMKtKX8hM+TTekGB5oNtTird

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2888	1.exe
3028	sdfsdfsdf.exe

Loads dropped DLL 2 IoCs

pid	Process
1176	b7e527e572d6abb99dd0a02820828d29.exe
1176	b7e527e572d6abb99dd0a02820828d29.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b7e527e572d6abb99dd0a02820828d29.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	sdfsdfsdf.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\sdfsdfsdf.exe	1.exe
File opened for modification	C:\Windows\sdfsdfsdf.exe	1.exe
File opened for modification	C:\Windows\sdfsdfsdf.cfg	sdfsdfsdf.exe
File created	C:\Windows\sdfsdfsdf.cfg	sdfsdfsdf.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International	1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Control Panel\International\sDate = "-"	1.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodisconnect = 00000000	1.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	sdfsdfsdf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sdfsdfsdf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	sdfsdfsdf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	sdfsdfsdf.exe
Key created	\REGISTRY\USER\.Default\Software\Microsoft\Windows\CurrentVersion\Internet Settings	1.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International	sdfsdfsdf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\sDate = "-"	sdfsdfsdf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	sdfsdfsdf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	sdfsdfsdf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\EnableAutodial = 00000000	1.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

pid	Process
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe
3028	sdfsdfsdf.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2580	DllHost.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2888	1176	b7e527e572d6abb99dd0a02820828d29.exe	29
PID 1176 wrote to memory of 2888	1176	b7e527e572d6abb99dd0a02820828d29.exe	29
PID 1176 wrote to memory of 2888	1176	b7e527e572d6abb99dd0a02820828d29.exe	29
PID 1176 wrote to memory of 2888	1176	b7e527e572d6abb99dd0a02820828d29.exe	29

C:\Users\Admin\AppData\Local\Temp\b7e527e572d6abb99dd0a02820828d29.exe
"C:\Users\Admin\AppData\Local\Temp\b7e527e572d6abb99dd0a02820828d29.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\1.exe
  "C:\Users\Admin\AppData\Local\Temp\1.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Modifies Control Panel
  - Modifies data under HKEY_USERS
  PID:2888

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2580

C:\Windows\sdfsdfsdf.exe
C:\Windows\sdfsdfsdf.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2.jpg

Filesize
19KB

MD5
3b3968fbe6aa0cd464711c67b6a43e50

SHA1
89bf44d7e79ae9a414e869891abaa4f0c2b4e93d

SHA256
bc0f6ed81888cf47ba0978c7403d7bea8bfcd4496a66f6a47b15dd635fdd5500

SHA512
baad5243e76f9ed6d2f1216b477215d72dcac18e7db39e792eedf345535bbb81c9df16e47b95375e091db5258d34b1c748df0ccc819378e693edd75172e6563c

Download Submit
\Users\Admin\AppData\Local\Temp\1.exe

Filesize
201KB

MD5
10a3dbcb3a714de2187dec1cfb0d4f9e

SHA1
fc58aa2afdde837df3ee86986595c717dda849fb

SHA256
3716ad0687ab5868947c7460bcb5c7e75bbbabbc3e06f447b5df146e83357dd4

SHA512
509d07de9b985ef680fbc66998eb130cce3293ecceb80a4509514c84bc5c082b414a6dcca9af7facef4ee814b34b1e030f94978b4688380dd0c121a71c0b12bf

Download Submit
memory/1176-13-0x0000000002820000-0x0000000002822000-memory.dmp

Filesize
8KB

Download
memory/1176-1-0x0000000000330000-0x0000000000373000-memory.dmp

Filesize
268KB

Download
memory/1176-11-0x0000000000390000-0x0000000000391000-memory.dmp

Filesize
4KB

Download
memory/1176-12-0x00000000004A0000-0x00000000004A1000-memory.dmp

Filesize
4KB

Download
memory/1176-9-0x0000000000470000-0x0000000000471000-memory.dmp

Filesize
4KB

Download
memory/1176-6-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/1176-5-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/1176-4-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1176-3-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/1176-2-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/1176-0-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1176-8-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/1176-24-0x0000000002E60000-0x0000000002EEB000-memory.dmp

Filesize
556KB

Download
memory/1176-7-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1176-32-0x0000000002E60000-0x0000000002EEB000-memory.dmp

Filesize
556KB

Download
memory/1176-25-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/1176-31-0x0000000000330000-0x0000000000373000-memory.dmp

Filesize
268KB

Download
memory/2580-16-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2580-14-0x0000000000230000-0x0000000000232000-memory.dmp

Filesize
8KB

Download
memory/2580-41-0x0000000000350000-0x0000000000351000-memory.dmp

Filesize
4KB

Download
memory/2888-27-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2888-38-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3028-37-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3028-40-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads