f6791f317ce9a8151584bd59f746ee5a73e10fe136edaa9cd8b87c3764b1a392

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bbfa62b6c7c379f1272b0b199d754d8e.exe
Size 496KB
Sample240309-q8dclahb79
SHA256 f6791f317ce9a8151584bd59f746ee5a73e10fe136edaa9cd8b87c3764b1a392
MD5 bbfa62b6c7c379f1272b0b199d754d8e
SHA1 906aa1f059cf51351a02fa2d78bd20e12b4f0d4c
SHA512 0473d624e91442049c90ac892c405622fe473ff373b0f6aa3f99a895b6c4859001aba8fd20db530022d6f186eadf14cb938fb3cb97e9c9fcd57fbde2dab286bf
SSDEEP 12288:hW0d5M1ibCZ87uR7RDdbXtQKDhh25cvU2KlwoH9ya3k:hZM1a5eRBrZX0BlBwh
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

adware bootkit persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	341d.exe

Executes dropped EXE 4 IoCs

pid	Process
3996	341d.exe
3124	341d.exe
3332	341d.exe
4520	mtv.exe

Loads dropped DLL 33 IoCs

pid	Process
4068	regsvr32.exe
3332	341d.exe
2976	rundll32.exe
1424	rundll32.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe
3332	341d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\plc = "c:\\windows\\system32\\rundll32.exe C:\\Windows\\system32/341e.dll,Always"	bbfa62b6c7c379f1272b0b199d754d8e.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCAA0766-15FC-4aec-A010-F4605D272581}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FCAA0766-15FC-4aec-A010-F4605D272581}\	regsvr32.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	\??\PhysicalDrive0	341d.exe
File opened for modification	\??\PhysicalDrive0	rundll32.exe

Drops file in System32 directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\s.exe	mtv.exe
File opened for modification	C:\Windows\SysWOW64\a1l8.dll	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\14rb.exe	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\4f3r.dll	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\4f3r.dlltmp	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\b34o.dll	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\b34o.dlltmp	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\3bef.dll	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\b3fs.dll	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\144d.exe	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\341d.exe	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\a1l8.dlltmp	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\b4cb.dll	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\341e.dll	bbfa62b6c7c379f1272b0b199d754d8e.exe
File created	C:\Windows\SysWOW64\-5-395759	rundll32.exe
File created	C:\Windows\SysWOW64\12d	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\1ba4.dll	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\34ua.exe	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\SysWOW64\b4cb.dlltmp	bbfa62b6c7c379f1272b0b199d754d8e.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\14ba.exe	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\a34b.flv	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\4bad.flv	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\ba8d.flv	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\6f1u.bmp	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\a8fd.exe	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\ba8u.bmp	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\bf14.bmp	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\8f6.exe	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\ba8d.exe	bbfa62b6c7c379f1272b0b199d754d8e.exe
File created	C:\Windows\Tasks\ms.job	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\f6f.bmp	bbfa62b6c7c379f1272b0b199d754d8e.exe
File opened for modification	C:\Windows\a8f.flv	bbfa62b6c7c379f1272b0b199d754d8e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 47 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\ProgID\ = "BHO.FffPlayer.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\ = "BHO 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\b34o.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\ = "CFffPlayer Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\VersionIndependentProgID\ = "BHO.FffPlayer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\InprocServer32\ThreadingModel = "apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\ = "{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\TypeLib\ = "{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ = "IFffPlayer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ = "IFffPlayer"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\ = "{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\ = "CFffPlayer Object"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CLSID\ = "{FCAA0766-15FC-4aec-A010-F4605D272581}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\ = "CFffPlayer Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer.1\CLSID\ = "{FCAA0766-15FC-4aec-A010-F4605D272581}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C573EEC-FF56-4312-BEBA-F9BBD3387824}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BHO.FffPlayer\CurVer\ = "BHO.FffPlayer.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\InprocServer32\ = "C:\\Windows\\SysWow64\\b34o.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCAA0766-15FC-4aec-A010-F4605D272581}\AppID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8A4F328C-C9F4-4449-A0DF-A756A6B52ABF}\1.0\FLAGS\ = "0"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3332	341d.exe
3332	341d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4520	mtv.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 4272	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	85
PID 1704 wrote to memory of 4272	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	85
PID 1704 wrote to memory of 4272	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	85
PID 1704 wrote to memory of 2324	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	86
PID 1704 wrote to memory of 2324	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	86
PID 1704 wrote to memory of 2324	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	86
PID 1704 wrote to memory of 2064	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	87
PID 1704 wrote to memory of 2064	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	87
PID 1704 wrote to memory of 2064	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	87
PID 1704 wrote to memory of 1884	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	88
PID 1704 wrote to memory of 1884	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	88
PID 1704 wrote to memory of 1884	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	88
PID 1704 wrote to memory of 4068	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	89
PID 1704 wrote to memory of 4068	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	89
PID 1704 wrote to memory of 4068	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	89
PID 1704 wrote to memory of 3996	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	90
PID 1704 wrote to memory of 3996	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	90
PID 1704 wrote to memory of 3996	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	90
PID 1704 wrote to memory of 3124	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	92
PID 1704 wrote to memory of 3124	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	92
PID 1704 wrote to memory of 3124	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	92
PID 3332 wrote to memory of 2976	3332	341d.exe	95
PID 3332 wrote to memory of 2976	3332	341d.exe	95
PID 3332 wrote to memory of 2976	3332	341d.exe	95
PID 1704 wrote to memory of 4520	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	96
PID 1704 wrote to memory of 4520	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	96
PID 1704 wrote to memory of 4520	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	96
PID 1704 wrote to memory of 1424	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	97
PID 1704 wrote to memory of 1424	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	97
PID 1704 wrote to memory of 1424	1704	bbfa62b6c7c379f1272b0b199d754d8e.exe	97

C:\Users\Admin\AppData\Local\Temp\bbfa62b6c7c379f1272b0b199d754d8e.exe
"C:\Users\Admin\AppData\Local\Temp\bbfa62b6c7c379f1272b0b199d754d8e.exe"
1⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/a1l8.dll"
  2⤵
  PID:4272
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/b4cb.dll"
  2⤵
  PID:2324
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/4f3r.dll"
  2⤵
  PID:2064
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /u /s "C:\Windows\system32/b34o.dll"
  2⤵
  PID:1884
- C:\Windows\SysWOW64\regsvr32.exe
  C:\Windows\system32\regsvr32.exe /s "C:\Windows\system32/b34o.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:4068
- C:\Windows\SysWOW64\341d.exe
  C:\Windows\system32/341d.exe -i
  2⤵
  - Executes dropped EXE
  PID:3996
- C:\Windows\SysWOW64\341d.exe
  C:\Windows\system32/341d.exe -s
  2⤵
  - Executes dropped EXE
  PID:3124
- C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exe
  C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  PID:4520
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32 C:\Windows\system32/341e.dll, Always
  2⤵
  - Loads dropped DLL
  PID:1424

C:\Windows\SysWOW64\341d.exe
C:\Windows\SysWOW64\341d.exe
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32 C:\Windows\system32/341e.dll,Always
  2⤵
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

b.dll

Path C:\Users\Admin\AppData\Local\Temp\h8nil4o8\b.dll
Size 116KB
SHA256 ffbb8af7e02c60f2c5c2352c7d42689ea3c97a8a6c15e9e37c3d0d09cc644c0b
MD5 261dbf7c444223eda448424231a9d945
SHA1 0a273b54b296f81e6112adc7d7a0ae454cb9ffbc
SHA512 6fb5766ee8e914c4f25413835615ec5092406d7b7c7d238a1cded51b7b74ff39db126c029090a87aca380d0c627ed6d4b1a3e2607cd249253bf0df1dc32abc05
SSDEEP 3072:7Lm7aXlHsa7XYIRptVmAhFR45ZglCOnkkk9wFJrz:+7cMlIRrscWZDOnkkk9G
MD5 SHA1 SHA512 SSDEEP

Submit Download

mtv.exe

Path C:\Users\Admin\AppData\Local\Temp\h8nil4o8\mtv.exe
Size 48KB
SHA256 ac5c782140fd4dfa6c327d475a4a159215fe4e0f7a268407490c72c7dec95169
MD5 2f99de965597aa02960c87b15ebca710
SHA1 42e08a74fd34bbd39ca676aacc0d9ded49519722
SHA512 d4d5d03b1ec407a1761f08d897d479203388053173b1cffb30ad48915e29661a7bcaf0c1fb8619cb0556842cd150ed773b33d4badfc9e79435559efda88205c5
SSDEEP 768:5prrpvqi+M21+ICbR7zKc+u7gnV0g9KKcnFAerVoO:/npvqiz21ohD+u7gnV0gcFAerz
MD5 SHA1 SHA512 SSDEEP

Submit Download

p.dll

Path C:\Users\Admin\AppData\Local\Temp\h8nil4o8\p.dll
Size 414KB
SHA256 e3d57faa934f517e07c84d08ca98f51df5f267d16a69ce6bf6d816a7e023f150
MD5 16486c2292159e17c9b661610f102fb6
SHA1 69e9a2876195d50bebd146c5e39f059661efc80e
SHA512 895d24ac874ab7bc9893ebbbb3eae99766c5f0dae2af462ca642b87640cdf8988e37d97e67402288eb71014596b7f4a620b349b5d32d7cd8325b5931fa7376ef
SSDEEP 12288:yE53yxegp8lOWSHrcxQFhE4sLgp0o18abXOuCDdAd:yE5AHgwsLPo18VuCDSd
MD5 SHA1 SHA512 SSDEEP

Submit Download

s.exe

Path C:\Users\Admin\AppData\Local\Temp\h8nil4o8\s.exe
Size 120KB
SHA256 4175461dc134cae5aa98d34ebeba9b67ba2912db6bf3f5407696d6472a6faf56
MD5 e88183af26bc82855db22f6d110e5a90
SHA1 bad7dd72189d4051b5eb7eb7f00486f4b86ed405
SHA512 618f3826cda3cb92f95aaf3987a8d45edd4a8e55f180066cac94f2738efe56db291c204e9159ac8e1e9f1c53f7c1fb4ab6acf8870966123976a268c1805ff45c
SSDEEP 3072:DQDxkuHsdKZlFwUx+B4+wQ7Ocn81qb0liPfFJrz:Ek060L1x+K+P8Ib7PX
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\kesr87\tmp.exe
Size 60KB
SHA256 d90058aa71723c213fcfd4638d3434d48c12fe47d0b5c1cf2f2914a50ffa028d
MD5 f1c9bc29224931b5b969ae63a8b299d1
SHA1 62d1cdb3369023e34a920b1bdc69ceb1e87982c1
SHA512 7354dd68bd003a7a0db4e2fe5e98e93a06f5eaf302847cf7ff1d35da2573c7ae9de37102285ff48d3b3f7bd9813d92b040862b5c19299b59514943be7e5726ec
SSDEEP 1536:zsyq+Np2q0FEIgAt7hTpg6ybsIUF2Hwj/bYx:Ay1Np2q0FEe7h9uf02HIO
MD5 SHA1 SHA512 SSDEEP

Submit Download

b34o.dll

Path C:\Windows\SysWOW64\b34o.dll
Size 9KB
SHA256 7a5fd32fd11c14c50ece92d3b6ef52541e5fe236fb4abc40cf0b4226c007d744
MD5 ca551a673479cc02e0007fc468f2448a
SHA1 bd6c81efdee5d8f5bf4fa57b2eb2297dc9d64598
SHA512 93e46ce3e252a3729ee55280583925d9c62ce3f72d31f2d16f7fef4a350fe2b61db8d43d7306f76551d5b226e1a7e445d6a05acb22e7bad8893d2ec680f15550
SSDEEP 192:bQo1vcvMUy+/3OxZ0MXXY2Dm+C3X3JiDytYpsf1q+J+xbmmva8NV:Uo1vsBPQKgI2Dmz3JiDQ8sf1q82b9S8r
MD5 SHA1 SHA512 SSDEEP

Submit Download