Overview

overview

8

Static

static

68778eda7c...cf.exe

windows7_x64

8

68778eda7c...cf.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    44s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-05-2022 00:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    68778eda7cc4b89ea1302bf9d6a91aa0c488fd7e9c959bd8a6dbef25d85baccf.exe

  • Size

    956KB

  • MD5

    e2cba8e39ab58930e9b9309e3738f0ff

  • SHA1

    30634c4f51fa739bdbd280d2ccb39ae9b096aaab

  • SHA256

    68778eda7cc4b89ea1302bf9d6a91aa0c488fd7e9c959bd8a6dbef25d85baccf

  • SHA512

    6f5a88aca725ad714e9956b7f205aecafacb3d3df0d37e8d3a58beced1e128dc3fc4938f84f3ca7197c4626cef2c506c879986784c73515c87f5edc8b5c8cfb7

Score
8/10
bootkitpersistenceupx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\68778eda7cc4b89ea1302bf9d6a91aa0c488fd7e9c959bd8a6dbef25d85baccf.exe
    "C:\Users\Admin\AppData\Local\Temp\68778eda7cc4b89ea1302bf9d6a91aa0c488fd7e9c959bd8a6dbef25d85baccf.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:1260

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1260-54-0x00000000753C1000-0x00000000753C3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1260-55-0x0000000010000000-0x000000001000B000-memory.dmp
    Filesize

    44KB

    Download
  • memory/1260-56-0x0000000010000000-0x000000001000B000-memory.dmp
    Filesize

    44KB

    Download