19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 03:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe
Size

9.2MB
MD5

88b8a5c736bc923f1c5811d9b716535b
SHA1

7a4ce5f7f52a578c21e13ef865e2d45a3fad5f25
SHA256

19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a
SHA512

2b4a6cfc90b6b1f1d5f7a46ac75fb3117cfd458c8c698f84b1fa04e73f86a371700405ca075c2d1d04f0edec3dffff8400d09a94951283797319073e077f1560
SSDEEP

196608:plLXXy+28tMj7JfRxaSpScs7sSEdJiFnhxqPjktin8frmfiStvS:vXXywtCnQSpULEbiFnhIjzn8juBS

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe

description ioc process

File opened for modification \??\PhysicalDrive0 19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe

pid process

2928 19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe

pid process

2928 19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe

description pid process

Token: SeDebugPrivilege 2928 19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe

description	pid	process
Token: SeDebugPrivilege	2928	19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe

pid	process
2928	19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe
2928	19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe

C:\Users\Admin\AppData\Local\Temp\19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe
"C:\Users\Admin\AppData\Local\Temp\19282c29ab887c92e77ee8d4bc40ed76c7d149aa33b70648775195ac8bf33d2a.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2928

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2928-2-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2928-0-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2928-4-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2928-5-0x0000000000400000-0x000000000192A000-memory.dmp

Filesize
21.2MB

Download
memory/2928-8-0x0000000010000000-0x00000000101A4000-memory.dmp

Filesize
1.6MB

Download
memory/2928-12-0x0000000000400000-0x000000000192A000-memory.dmp

Filesize
21.2MB

Download
memory/2928-13-0x0000000000400000-0x000000000192A000-memory.dmp

Filesize
21.2MB

Download