890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234

General

Target

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Size

453KB
MD5

4c9b1ced2955f80a42c3c9b5613f984f
SHA1

1a5c4f30c9ad3f1d683bcbe79580a0ba4fbc0c9b
SHA256

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234
SHA512

fc095d5111a3d5e03eedf2ea4f480ef4d312d81f20f15d6a74eefbc30750d5fc81cc0905b87ae9e041871e0387e59c69a30ec2b9ed0dd0b222e9f37ea0152da3
SSDEEP

12288:MI+U9rUSqIOtxnTir5xmXhq+NmJepW1K3DnsxJ84g2L:jBrUSrITir5xEhW4Ds42L

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1976-58-0x0000000000320000-0x000000000032F000-memory.dmp	upx
behavioral1/memory/1976-60-0x0000000000320000-0x000000000032F000-memory.dmp	upx
behavioral1/memory/1976-65-0x0000000000320000-0x000000000032F000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

pid process

1976 890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

description ioc process

File opened for modification \??\PhysicalDrive0 890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

Modifies registry class 33 IoCs

Processes:

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\ProgID\ = "PDFPrevHndlr.PDFPreviewHandler.1"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\0	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\FLAGS	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\TypeLib	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\HELPDIR	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\HELPDIR\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\VersionIndependentProgID\ = "PDFPrevHndlr.PDFPreviewHandler"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\ = "Ifoxir Class"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\InprocServer32\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\ProgID	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\0\win32	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\FLAGS\ = "0"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\HELPDIR\ = "[{C89361FC-B7A8-405F-8329-DCAB7592E579}]"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\InprocServer32	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\ = "msb1stAr 1.0 Type Library"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\VersionIndependentProgID\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\InprocServer32\ = "C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\pdfprevhndlr.dll"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\ProgID\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\0\win32\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\0\win32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1STAR.DLL"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\FLAGS\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\TypeLib\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}\1.0\0\	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\TypeLib\ = "{D1BE8F8C-94D4-2C2A-5AE1-D3053AE4BA75}"	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C3CFF64-4502-4379-B193-639FD4F1C4E7}\VersionIndependentProgID	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

pid	process
1976	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
1976	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe

description	pid	process	target process
PID 1976 wrote to memory of 1684	1976	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe	cmd.exe
PID 1976 wrote to memory of 1684	1976	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe	cmd.exe
PID 1976 wrote to memory of 1684	1976	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe	cmd.exe
PID 1976 wrote to memory of 1684	1976	890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe
"C:\Users\Admin\AppData\Local\Temp\890c977fc1ef75dac235c3a2d3415b297a3abbfb406b673fcaa28dc9c88ce234.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\cmd.exe
cmd
2⤵
PID:1684

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\libnspr4.dll
Filesize
10KB

MD5
28a57355d9583b66e51ad978384c159e

SHA1
b8fe4ddb6187cdee0e89c02bab4a104f406d16da

SHA256
81ed76156df0de1caae6730a091f29978493881b54a2d6fbfb43c47153b6fadd

SHA512
991a288ed0f033eb8f54e567a6264a6111f795bd61a1cd600e210730d7ed39c89e735480dc6f0e4026eafad730ae8dc23ec7bc7600a14a2ac9d652638c02ee3e

Download Submit
memory/1684-56-0x0000000000000000-mapping.dmp

Download
memory/1976-54-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1976-55-0x0000000000300000-0x0000000000311000-memory.dmp

Filesize
68KB

Download
memory/1976-58-0x0000000000320000-0x000000000032F000-memory.dmp

Filesize
60KB

Download
memory/1976-60-0x0000000000320000-0x000000000032F000-memory.dmp

Filesize
60KB

Download
memory/1976-59-0x0000000000300000-0x0000000000311000-memory.dmp

Filesize
68KB

Download
memory/1976-61-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

Filesize
8KB

Download
memory/1976-63-0x0000000000400000-0x0000000000552000-memory.dmp

Filesize
1.3MB

Download
memory/1976-64-0x0000000000300000-0x000000000030C000-memory.dmp

Filesize
48KB

Download
memory/1976-65-0x0000000000320000-0x000000000032F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads