9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15

General

Target

9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
Size

188KB
MD5

6f9536b102360206740d2f0feb3ee1ab
SHA1

6dec0adb46d54e6f7a6c1bce158c9235f2188028
SHA256

9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15
SHA512

8792cb3b664089084d8a0a47d3905334bdbbdbf591dee38a824601273c18a0c4c3b162a4ffd0ae014719291e0a7b84b60c08b0d069da87ccb1a849a502150849
SSDEEP

3072:DkfYM5ASFNYsY5uXHs9xmcqAQaLioyH/Tb9s33pn:QdASFNvYA3obLPyH+

Score

6^/10

bootkit persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\""	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svhost.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\svhost.exe\""	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3304 set thread context of 888	3304	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	81
PID 888 set thread context of 2272	888	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	82

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2272	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
2272	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
2272	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
2272	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2272	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3304	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
888	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 888	3304	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	81
PID 3304 wrote to memory of 888	3304	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	81
PID 3304 wrote to memory of 888	3304	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	81
PID 3304 wrote to memory of 888	3304	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	81
PID 3304 wrote to memory of 888	3304	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	81
PID 3304 wrote to memory of 888	3304	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	81
PID 3304 wrote to memory of 888	3304	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	81
PID 3304 wrote to memory of 888	3304	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	81
PID 888 wrote to memory of 2272	888	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	82
PID 888 wrote to memory of 2272	888	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	82
PID 888 wrote to memory of 2272	888	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	82
PID 888 wrote to memory of 2272	888	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	82
PID 888 wrote to memory of 2272	888	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	82
PID 888 wrote to memory of 2272	888	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	82
PID 888 wrote to memory of 2272	888	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	82
PID 888 wrote to memory of 2272	888	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	82
PID 888 wrote to memory of 2272	888	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	82
PID 2272 wrote to memory of 3060	2272	9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe	40

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3060
- C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
  "C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
    "C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe
      "C:\Users\Admin\AppData\Local\Temp\9d31fcc2f5ca7ba6128dce492b2a5e57a5e64800ce7a8678b50d5d798bea3c15.exe"
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: RenamesItself
      Suspicious use of WriteProcessMemory
      PID:2272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/888-136-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/888-144-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/888-147-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2272-142-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2272-145-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2272-146-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2272-149-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3060-148-0x0000000000770000-0x000000000077E000-memory.dmp

Filesize
56KB

Download
memory/3304-132-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3304-138-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing