1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862

Analysis

max time kernel
7s
max time network
157s
platform
windows7_x64
resource
win7-20220414-en
submitted
25-05-2022 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
Size

7.4MB
MD5

12b95b6050d0cacd4a28cd8adc49e832
SHA1

e2b9443ec49eb4907fe4fb7c3ed2da3c6d0ab810
SHA256

1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862
SHA512

f07eb61343a3afede343cc9f6583fcb7b6e77e7819a34af03a8a677aeb4f52285cda890cf80c9b442e811ddf696d6715b2eb1596cc162710eb884d873f2163af

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

ComInfo.dllShowDrive.dl_ShowEFI.dl_Getptw.dll

pid process

1680 ComInfo.dll
1656 ShowDrive.dl_
1288 ShowEFI.dl_
1828 Getptw.dll

pid	process
1680	ComInfo.dll
1656	ShowDrive.dl_
1288	ShowEFI.dl_
1828	Getptw.dll

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Roaming\WININST~145\ComInfo.dll	upx
C:\Users\Admin\AppData\Roaming\WININST~145\ComInfo.dll	upx
C:\Users\Admin\AppData\Roaming\WININST~145\ComInfo.dll	upx
\Users\Admin\AppData\Roaming\WININST~145\ComInfo.dll	upx

Loads dropped DLL 8 IoCs

Processes:

1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.execmd.execmd.execmd.exe

pid	process
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1344	cmd.exe
1344	cmd.exe
1960	cmd.exe
1960	cmd.exe
1384	cmd.exe
1384	cmd.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exeShowDrive.dl_

description	ioc	process
File opened (read-only)	\??\l:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\m:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\p:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\y:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\z:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\g:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\j:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\k:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\s:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\u:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\v:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\r:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\t:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\a:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\f:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\h:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\i:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\o:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\q:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\w:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\D:	ShowDrive.dl_
File opened (read-only)	\??\b:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\e:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\n:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
File opened (read-only)	\??\x:	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe

Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

Getptw.dllComInfo.dllShowEFI.dl_

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Getptw.dll
File opened for modification	\??\PhysicalDrive0	ComInfo.dll
File opened for modification	\??\PhysicalDrive0	ShowEFI.dl_

NTFS ADS 1 IoCs

Processes:

ComInfo.dll

description ioc process

File opened for modification C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2 ComInfo.dll

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:{impersonationLevel=impersonate}!\root\cimv2	ComInfo.dll

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Getptw.dll1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe

pid	process
1828	Getptw.dll
1828	Getptw.dll
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exeComInfo.dll

pid	process
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1680	ComInfo.dll
1680	ComInfo.dll
1680	ComInfo.dll
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe

Suspicious use of SendNotifyMessage 8 IoCs

Processes:

1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exeComInfo.dll

pid	process
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1680	ComInfo.dll
1680	ComInfo.dll
1680	ComInfo.dll
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1596 wrote to memory of 1680	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	ComInfo.dll
PID 1596 wrote to memory of 1680	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	ComInfo.dll
PID 1596 wrote to memory of 1680	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	ComInfo.dll
PID 1596 wrote to memory of 1680	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	ComInfo.dll
PID 1596 wrote to memory of 1344	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1596 wrote to memory of 1344	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1596 wrote to memory of 1344	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1596 wrote to memory of 1344	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1344 wrote to memory of 1656	1344	cmd.exe	ShowDrive.dl_
PID 1344 wrote to memory of 1656	1344	cmd.exe	ShowDrive.dl_
PID 1344 wrote to memory of 1656	1344	cmd.exe	ShowDrive.dl_
PID 1344 wrote to memory of 1656	1344	cmd.exe	ShowDrive.dl_
PID 1596 wrote to memory of 1960	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1596 wrote to memory of 1960	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1596 wrote to memory of 1960	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1596 wrote to memory of 1960	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1960 wrote to memory of 1288	1960	cmd.exe	ShowEFI.dl_
PID 1960 wrote to memory of 1288	1960	cmd.exe	ShowEFI.dl_
PID 1960 wrote to memory of 1288	1960	cmd.exe	ShowEFI.dl_
PID 1960 wrote to memory of 1288	1960	cmd.exe	ShowEFI.dl_
PID 1596 wrote to memory of 1384	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1596 wrote to memory of 1384	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1596 wrote to memory of 1384	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1596 wrote to memory of 1384	1596	1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe	cmd.exe
PID 1384 wrote to memory of 1828	1384	cmd.exe	Getptw.dll
PID 1384 wrote to memory of 1828	1384	cmd.exe	Getptw.dll
PID 1384 wrote to memory of 1828	1384	cmd.exe	Getptw.dll
PID 1384 wrote to memory of 1828	1384	cmd.exe	Getptw.dll

C:\Users\Admin\AppData\Local\Temp\1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe
"C:\Users\Admin\AppData\Local\Temp\1c1e78e8633a5e4408bbd5d3c641ff2af2a457084e6a19e2c4fc5a196867e862.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Roaming\WININST~145\ComInfo.dll
  C:\Users\Admin\AppData\Roaming\WININST~145\ComInfo.dll
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WININST~145\ShowDrive.dl_ *
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1344
- - C:\Users\Admin\AppData\Roaming\WININST~145\ShowDrive.dl_
    C:\Users\Admin\AppData\Roaming\WININST~145\ShowDrive.dl_ *
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    PID:1656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WININST~145\Getptw.dll -a/part
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\WININST~145\ShowEFI.dl_
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1960

C:\Users\Admin\AppData\Roaming\WININST~145\Getptw.dll
C:\Users\Admin\AppData\Roaming\WININST~145\Getptw.dll -a/part
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:1828

C:\Users\Admin\AppData\Roaming\WININST~145\ShowEFI.dl_
C:\Users\Admin\AppData\Roaming\WININST~145\ShowEFI.dl_
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\WININST~145\ComInfo.dll

Filesize
491KB

MD5
21b0345bde3fd0a5ef01e493f83ae784

SHA1
c059a60f3a24f496fd36d6fb9742b28ccd7fb81d

SHA256
abc52fc80a21914f6cd1f0412bbdaf0e19789bd0e98e4086bdff2386f555f520

SHA512
4f29b14b09ff8f4969bb6554499bd6515c0829a360a8f6ab935435df2fca8a40325d1e340ebb16fb3aa23084e2e1c95ba8406dfd4b23cd5978026890eb805e4a

Download Submit
C:\Users\Admin\AppData\Roaming\WININST~145\ComInfo.dll

Filesize
491KB

MD5
21b0345bde3fd0a5ef01e493f83ae784

SHA1
c059a60f3a24f496fd36d6fb9742b28ccd7fb81d

SHA256
abc52fc80a21914f6cd1f0412bbdaf0e19789bd0e98e4086bdff2386f555f520

SHA512
4f29b14b09ff8f4969bb6554499bd6515c0829a360a8f6ab935435df2fca8a40325d1e340ebb16fb3aa23084e2e1c95ba8406dfd4b23cd5978026890eb805e4a

Download Submit
C:\Users\Admin\AppData\Roaming\WININST~145\Computer.dll

Filesize
68KB

MD5
3aaae11720c12e147d5104dcf5f41565

SHA1
2b54cbe8c150217959c0ec0ad81baee75b684932

SHA256
9f8decf4c7a77d89e5cc8cc1b44eddca5d21f1dcef551720b3515a43865796b0

SHA512
df610e6a8b1a1325836e6a9e7008546c5177a0c10b976a253f28957eed58c52fed979ff5f35b8aa4faa56abc3bdc01483bef8ce3ade4d9024bb5444f50dfde00

Download Submit
C:\Users\Admin\AppData\Roaming\WININST~145\Computer.dll

Filesize
65KB

MD5
7e7b82b0c981cf1917bba44ab27a3934

SHA1
4547c82224b509ca4d20a46b02df44a5de76b1f5

SHA256
5d2ff64a7179544e1528b8b595675812b5ba6e9b6ea8acb96251ad3f8acd26de

SHA512
e4256082df399aabf6b00526c90c2a6b529b85d14baf7dad5a698c123a8eaed49a95ddf75a4d54b296ca809aa650389bd9bffb7f16e5b283cf389984f5d18efe

Download Submit
C:\Users\Admin\AppData\Roaming\WININST~145\Getptw.dll

Filesize
21KB

MD5
94d297ccb80b1f7940ea98ffdfc25257

SHA1
9461b88f14384e5e5a0dd0147552e81bf5dbfa1e

SHA256
dd4694e89ae067e49e4f9581782a277eb0fab052aa1539717fecf8449a872f75

SHA512
303f81ffc71d5aa8a8ce733c9104d5e4172c098a78f78baac001a90161493f21c907bc49dc28a6424596862deec9311e12bdd3d92df8ba08c041786b262b4256

Download Submit
C:\Users\Admin\AppData\Roaming\WININST~145\Getptw.dll

Filesize
21KB

MD5
94d297ccb80b1f7940ea98ffdfc25257

SHA1
9461b88f14384e5e5a0dd0147552e81bf5dbfa1e

SHA256
dd4694e89ae067e49e4f9581782a277eb0fab052aa1539717fecf8449a872f75

SHA512
303f81ffc71d5aa8a8ce733c9104d5e4172c098a78f78baac001a90161493f21c907bc49dc28a6424596862deec9311e12bdd3d92df8ba08c041786b262b4256

Download Submit
C:\Users\Admin\AppData\Roaming\WININST~145\ShowDrive.dl_

Filesize
4KB

MD5
63f0697283a67db3f50b440f142044ed

SHA1
ea3ceae6750d9a481bf88012adfab874bcb67f80

SHA256
09c07db40dacd999e726786fc9a8f5e37688d94997f2692da63746f417851f0f

SHA512
967ca158809ecfc2baf99092f425876e137842b96446ca4b5b61fb75a244e479e739049895289de70b7656e5fafd1cb792ac1ce5d8eeb015e6ede7224898a028

Download Submit
C:\Users\Admin\AppData\Roaming\WININST~145\ShowDrive.dl_

Filesize
4KB

MD5
63f0697283a67db3f50b440f142044ed

SHA1
ea3ceae6750d9a481bf88012adfab874bcb67f80

SHA256
09c07db40dacd999e726786fc9a8f5e37688d94997f2692da63746f417851f0f

SHA512
967ca158809ecfc2baf99092f425876e137842b96446ca4b5b61fb75a244e479e739049895289de70b7656e5fafd1cb792ac1ce5d8eeb015e6ede7224898a028

Download Submit
C:\Users\Admin\AppData\Roaming\WININST~145\ShowEFI.dl_

Filesize
19KB

MD5
5aadc3b8ad1735a7a0e89c574e90c50f

SHA1
7370502043a42d434632f7221fbea2a7062f1f84

SHA256
cfe2144727f11e2cfb42e64be6773ad58cd6f6036c3027a2b9aad2c40946734f

SHA512
3e1c83824e2e58378e5e48399959f75addd251a83d6f01612f37c647cb940a6afbd7fed935f62ee9a02d2bddfb806f212c948f93b10463cb61795970b774be3e

Download Submit
C:\Users\Admin\AppData\Roaming\WININST~145\ShowEFI.dl_

Filesize
19KB

MD5
5aadc3b8ad1735a7a0e89c574e90c50f

SHA1
7370502043a42d434632f7221fbea2a7062f1f84

SHA256
cfe2144727f11e2cfb42e64be6773ad58cd6f6036c3027a2b9aad2c40946734f

SHA512
3e1c83824e2e58378e5e48399959f75addd251a83d6f01612f37c647cb940a6afbd7fed935f62ee9a02d2bddfb806f212c948f93b10463cb61795970b774be3e

Download Submit
\Users\Admin\AppData\Roaming\WININST~145\ComInfo.dll

Filesize
491KB

MD5
21b0345bde3fd0a5ef01e493f83ae784

SHA1
c059a60f3a24f496fd36d6fb9742b28ccd7fb81d

SHA256
abc52fc80a21914f6cd1f0412bbdaf0e19789bd0e98e4086bdff2386f555f520

SHA512
4f29b14b09ff8f4969bb6554499bd6515c0829a360a8f6ab935435df2fca8a40325d1e340ebb16fb3aa23084e2e1c95ba8406dfd4b23cd5978026890eb805e4a

Download Submit
\Users\Admin\AppData\Roaming\WININST~145\ComInfo.dll

Filesize
491KB

MD5
21b0345bde3fd0a5ef01e493f83ae784

SHA1
c059a60f3a24f496fd36d6fb9742b28ccd7fb81d

SHA256
abc52fc80a21914f6cd1f0412bbdaf0e19789bd0e98e4086bdff2386f555f520

SHA512
4f29b14b09ff8f4969bb6554499bd6515c0829a360a8f6ab935435df2fca8a40325d1e340ebb16fb3aa23084e2e1c95ba8406dfd4b23cd5978026890eb805e4a

Download Submit
\Users\Admin\AppData\Roaming\WININST~145\Getptw.dll

Filesize
21KB

MD5
94d297ccb80b1f7940ea98ffdfc25257

SHA1
9461b88f14384e5e5a0dd0147552e81bf5dbfa1e

SHA256
dd4694e89ae067e49e4f9581782a277eb0fab052aa1539717fecf8449a872f75

SHA512
303f81ffc71d5aa8a8ce733c9104d5e4172c098a78f78baac001a90161493f21c907bc49dc28a6424596862deec9311e12bdd3d92df8ba08c041786b262b4256

Download Submit
\Users\Admin\AppData\Roaming\WININST~145\Getptw.dll

Filesize
21KB

MD5
94d297ccb80b1f7940ea98ffdfc25257

SHA1
9461b88f14384e5e5a0dd0147552e81bf5dbfa1e

SHA256
dd4694e89ae067e49e4f9581782a277eb0fab052aa1539717fecf8449a872f75

SHA512
303f81ffc71d5aa8a8ce733c9104d5e4172c098a78f78baac001a90161493f21c907bc49dc28a6424596862deec9311e12bdd3d92df8ba08c041786b262b4256

Download Submit
\Users\Admin\AppData\Roaming\WININST~145\ShowDrive.dl_

Filesize
4KB

MD5
63f0697283a67db3f50b440f142044ed

SHA1
ea3ceae6750d9a481bf88012adfab874bcb67f80

SHA256
09c07db40dacd999e726786fc9a8f5e37688d94997f2692da63746f417851f0f

SHA512
967ca158809ecfc2baf99092f425876e137842b96446ca4b5b61fb75a244e479e739049895289de70b7656e5fafd1cb792ac1ce5d8eeb015e6ede7224898a028

Download Submit
\Users\Admin\AppData\Roaming\WININST~145\ShowDrive.dl_

Filesize
4KB

MD5
63f0697283a67db3f50b440f142044ed

SHA1
ea3ceae6750d9a481bf88012adfab874bcb67f80

SHA256
09c07db40dacd999e726786fc9a8f5e37688d94997f2692da63746f417851f0f

SHA512
967ca158809ecfc2baf99092f425876e137842b96446ca4b5b61fb75a244e479e739049895289de70b7656e5fafd1cb792ac1ce5d8eeb015e6ede7224898a028

Download Submit
\Users\Admin\AppData\Roaming\WININST~145\ShowEFI.dl_

Filesize
19KB

MD5
5aadc3b8ad1735a7a0e89c574e90c50f

SHA1
7370502043a42d434632f7221fbea2a7062f1f84

SHA256
cfe2144727f11e2cfb42e64be6773ad58cd6f6036c3027a2b9aad2c40946734f

SHA512
3e1c83824e2e58378e5e48399959f75addd251a83d6f01612f37c647cb940a6afbd7fed935f62ee9a02d2bddfb806f212c948f93b10463cb61795970b774be3e

Download Submit
\Users\Admin\AppData\Roaming\WININST~145\ShowEFI.dl_

Filesize
19KB

MD5
5aadc3b8ad1735a7a0e89c574e90c50f

SHA1
7370502043a42d434632f7221fbea2a7062f1f84

SHA256
cfe2144727f11e2cfb42e64be6773ad58cd6f6036c3027a2b9aad2c40946734f

SHA512
3e1c83824e2e58378e5e48399959f75addd251a83d6f01612f37c647cb940a6afbd7fed935f62ee9a02d2bddfb806f212c948f93b10463cb61795970b774be3e

Download Submit
memory/1288-71-0x0000000000000000-mapping.dmp

Download
memory/1344-61-0x0000000000000000-mapping.dmp

Download
memory/1384-73-0x0000000000000000-mapping.dmp

Download
memory/1596-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1656-65-0x0000000000000000-mapping.dmp

Download
memory/1680-57-0x0000000000000000-mapping.dmp

Download
memory/1828-77-0x0000000000000000-mapping.dmp

Download
memory/1960-67-0x0000000000000000-mapping.dmp

Download