91a55d98fb7de6ee8a7712c38d6c1cd6ce5baba3cb47293642810622a760643c

Analysis

max time kernel
150s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

91a55d98fb7de6ee8a7712c38d6c1cd6ce5baba3cb47293642810622a760643c.exe
Size

521KB
MD5

587e14efa81dfd0e75b16b1f2a710680
SHA1

5499d7df4f103a08c0550a74dc52b81a97f104b3
SHA256

91a55d98fb7de6ee8a7712c38d6c1cd6ce5baba3cb47293642810622a760643c
SHA512

3114a22daf2044fec002261395723bc0407f47bddbaf2c27bc8e4929e7b03e03096db21e8f82ad6781f5297567a72c3102e24fe9da1062764b5900e589180dcb
SSDEEP

12288:p6GSN04Wn4H+/HxdY+HiCTjVehziKfFmi+K3Y2A/4:p6GSNBWnDvxdY+HZT5ehziWU/4

Score

9^/10

bootkit persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0009000000022e15-133.dat	acprotect
behavioral2/files/0x0009000000022e15-134.dat	acprotect

Loads dropped DLL 2 IoCs

pid	Process
5076	91a55d98fb7de6ee8a7712c38d6c1cd6ce5baba3cb47293642810622a760643c.exe
5076	91a55d98fb7de6ee8a7712c38d6c1cd6ce5baba3cb47293642810622a760643c.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	91a55d98fb7de6ee8a7712c38d6c1cd6ce5baba3cb47293642810622a760643c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5076	91a55d98fb7de6ee8a7712c38d6c1cd6ce5baba3cb47293642810622a760643c.exe

C:\Users\Admin\AppData\Local\Temp\91a55d98fb7de6ee8a7712c38d6c1cd6ce5baba3cb47293642810622a760643c.exe
"C:\Users\Admin\AppData\Local\Temp\91a55d98fb7de6ee8a7712c38d6c1cd6ce5baba3cb47293642810622a760643c.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:5076

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rpi9CB2.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\rpi9CB2.tmp

Filesize
172KB

MD5
685f1cbd4af30a1d0c25f252d399a666

SHA1
6a1b978f5e6150b88c8634146f1406ed97d2f134

SHA256
0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

SHA512
6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

Download Submit
memory/5076-132-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/5076-135-0x0000000000630000-0x00000000006A3000-memory.dmp

Filesize
460KB

Download
memory/5076-136-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download