40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1

Analysis

max time kernel
91s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2022, 05:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
Size

237KB
MD5

59a334c58a4fc8be9cba0af31127b440
SHA1

276b3a7db6bcb20aa4de5550a77db696f1126165
SHA256

40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1
SHA512

b99e4e9e926a50c57d5b5f616df6ec778d60a6c83e4bd67811c23b4fab9adb14a72eeea1b9998b8d9a694407a16cea8341ffa1b1eb6ee7550129fbbb19acebb6
SSDEEP

3072:1lELL7XOCw0xQCdMey44tVkZj+8FzB7C1XWLmjPUXiYR8PyqsyuxCBM3PGuxCJTZ:+3kOMeaavF17EP6qyqsNxCSOCCJzZ

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4340-132-0x0000000000400000-0x0000000000489000-memory.dmp	upx
behavioral2/memory/4340-133-0x0000000000400000-0x0000000000489000-memory.dmp	upx

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\i:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\k:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\q:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\x:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\w:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\z:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\f:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\j:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\n:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\p:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\r:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\u:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\l:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\o:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\s:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\y:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\e:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\g:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\m:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\t:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
File opened (read-only)	\??\v:	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SAItest.txt	40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe

C:\Users\Admin\AppData\Local\Temp\40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe
"C:\Users\Admin\AppData\Local\Temp\40e77490e064616e15326abce79c33997edc7a07ce0c940a0a1dcfa5b8ce1af1.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
PID:4340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4340-132-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download
memory/4340-133-0x0000000000400000-0x0000000000489000-memory.dmp

Filesize
548KB

Download