0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c

Analysis

max time kernel
44s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe
Size

748KB
MD5

c6f237f5dc01f8799976986285f64a6f
SHA1

b05d6cdd25bb4878b947096a43342c564ec5cd98
SHA256

0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c
SHA512

82558951013b0561d557a4102ee21cd3e3fbadea3fbc7b6c0c74b4e1c75ce306f7679477dc682f50f365fef33e8ffcc80d5c74d42127b87e592f99b9e789f3b4
SSDEEP

12288:QK4SzOnd/1KReU744mkKIGldg8q3tQKdAAMwAG68hZyl+DjmLsz6KTfNoVS+EVGf:Mm4QLjv0dgTdQFAMwX68hZ8+DjmLg6iS

Score

9^/10

bootkit persistence

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000005c51-54.dat	acprotect
behavioral1/files/0x0008000000005c51-58.dat	acprotect
behavioral1/files/0x0008000000005c51-62.dat	acprotect

Loads dropped DLL 3 IoCs

pid	Process
1352	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe
1692	rundll32.exe
624	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27
PID 1692 set thread context of 624	1692	rundll32.exe	27

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
624	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	624	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 1692	1352	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe	26
PID 1352 wrote to memory of 1692	1352	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe	26
PID 1352 wrote to memory of 1692	1352	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe	26
PID 1352 wrote to memory of 1692	1352	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe	26
PID 1352 wrote to memory of 1692	1352	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe	26
PID 1352 wrote to memory of 1692	1352	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe	26
PID 1352 wrote to memory of 1692	1352	0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe	26
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27
PID 1692 wrote to memory of 624	1692	rundll32.exe	27

C:\Users\Admin\AppData\Local\Temp\0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe
"C:\Users\Admin\AppData\Local\Temp\0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\V22007~1.EPE,EncryptPE_Init2
  2⤵
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Users\Admin\AppData\Local\Temp\0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe
    C:\Users\Admin\AppData\Local\Temp\0d78a022196c705bb56cb2524a61074259ba59ae2fb1a0b9ad6629c49221cd9c.exe
    3⤵
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\V220071201.EPE

Filesize
489KB

MD5
b53f01dd944cd2a25eeee3cb8bc22355

SHA1
5489b92bab9c50d62f6042fbc50b25700a3c8137

SHA256
2e8d7ac98b4abaaddbe6bd3a66916e4ea8a87f5ce5615a6d13ee4f5c0c4cc3e8

SHA512
f4f9c5459e54c073a6042e4bab5a3c9e3d098989203c3021591f30f5a37f80eb77929b7881c18f1a69608500b3cab0822c79ddc6f77b1b16301131c3e41bb894

Download Submit
\Users\Admin\AppData\Local\Temp\V220071201.EPE

Filesize
489KB

MD5
b53f01dd944cd2a25eeee3cb8bc22355

SHA1
5489b92bab9c50d62f6042fbc50b25700a3c8137

SHA256
2e8d7ac98b4abaaddbe6bd3a66916e4ea8a87f5ce5615a6d13ee4f5c0c4cc3e8

SHA512
f4f9c5459e54c073a6042e4bab5a3c9e3d098989203c3021591f30f5a37f80eb77929b7881c18f1a69608500b3cab0822c79ddc6f77b1b16301131c3e41bb894

Download Submit
\Users\Admin\AppData\Local\Temp\V220071201.EPE

Filesize
489KB

MD5
b53f01dd944cd2a25eeee3cb8bc22355

SHA1
5489b92bab9c50d62f6042fbc50b25700a3c8137

SHA256
2e8d7ac98b4abaaddbe6bd3a66916e4ea8a87f5ce5615a6d13ee4f5c0c4cc3e8

SHA512
f4f9c5459e54c073a6042e4bab5a3c9e3d098989203c3021591f30f5a37f80eb77929b7881c18f1a69608500b3cab0822c79ddc6f77b1b16301131c3e41bb894

Download Submit
memory/624-74-0x0000000001DA8000-0x0000000001DAC000-memory.dmp

Filesize
16KB

Download
memory/624-66-0x0000000001DA8000-0x0000000001DAC000-memory.dmp

Filesize
16KB

Download
memory/624-146-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/624-75-0x0000000071120000-0x0000000071267000-memory.dmp

Filesize
1.3MB

Download
memory/624-145-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/624-64-0x0000000001DA8000-0x0000000001DAC000-memory.dmp

Filesize
16KB

Download
memory/624-65-0x0000000001DA8000-0x0000000001DAC000-memory.dmp

Filesize
16KB

Download
memory/624-80-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/624-67-0x0000000001DA8000-0x0000000001DAC000-memory.dmp

Filesize
16KB

Download
memory/624-68-0x000000000052D781-0x000000000052D973-memory.dmp

Filesize
498B

Download
memory/624-69-0x000000000052D781-0x000000000052D973-memory.dmp

Filesize
498B

Download
memory/624-70-0x0000000001DA4000-0x0000000001DA8000-memory.dmp

Filesize
16KB

Download
memory/624-71-0x0000000001DA8000-0x0000000001DAC000-memory.dmp

Filesize
16KB

Download
memory/624-79-0x0000000071209000-0x000000007120C000-memory.dmp

Filesize
12KB

Download
memory/624-73-0x0000000001DA4000-0x0000000001DA8000-memory.dmp

Filesize
16KB

Download
memory/624-144-0x0000000071120000-0x0000000071267000-memory.dmp

Filesize
1.3MB

Download
memory/624-124-0x0000000071120000-0x0000000071267000-memory.dmp

Filesize
1.3MB

Download
memory/624-72-0x0000000001DA4000-0x0000000001DA8000-memory.dmp

Filesize
16KB

Download
memory/624-118-0x0000000071120000-0x0000000071267000-memory.dmp

Filesize
1.3MB

Download
memory/624-106-0x0000000071120000-0x0000000071267000-memory.dmp

Filesize
1.3MB

Download
memory/624-83-0x0000000001DA4000-0x0000000001DA8000-memory.dmp

Filesize
16KB

Download
memory/624-85-0x0000000071120000-0x0000000071267000-memory.dmp

Filesize
1.3MB

Download
memory/624-91-0x0000000001DA4000-0x0000000001DA8000-memory.dmp

Filesize
16KB

Download
memory/624-92-0x0000000001DA4000-0x0000000001DA8000-memory.dmp

Filesize
16KB

Download
memory/624-93-0x0000000001DA8000-0x0000000001DAC000-memory.dmp

Filesize
16KB

Download
memory/624-94-0x0000000071120000-0x0000000071267000-memory.dmp

Filesize
1.3MB

Download
memory/1352-60-0x0000000000400000-0x000000000056F000-memory.dmp

Filesize
1.4MB

Download
memory/1352-55-0x0000000075B51000-0x0000000075B53000-memory.dmp

Filesize
8KB

Download
memory/1352-61-0x0000000071120000-0x0000000071267000-memory.dmp

Filesize
1.3MB

Download
memory/1692-84-0x0000000003070000-0x00000000031DF000-memory.dmp

Filesize
1.4MB

Download
memory/1692-82-0x0000000071120000-0x0000000071267000-memory.dmp

Filesize
1.3MB

Download