82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8

General

Target

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
Size

3.6MB
MD5

01a797fb3950fc40b793a2a930961b69
SHA1

e4a7a06b513e61baf2a3dbf7c1fff3946c6663cc
SHA256

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8
SHA512

60bec9c1fac173a161e4b84b0f151adbe76e14f6cad45268676f4bf2f8149e5475aeef244ed9ad312aa7ba15ac007cbb79a7fd4a18c912980cc8ec472a6a30ec
SSDEEP

49152:hDjeP+ApznKhqavgYjXOUzIeZwmX4N2hbYiPTUQmJTaId+s8KuqGaX0ToIBAUZL8:9jeP+ApznWI4XOiIGX4NuEmNJBAUZLO7

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/372-132-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-133-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-134-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-136-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-140-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-138-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-142-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-144-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-146-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-148-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-150-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-152-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-154-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-156-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-158-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-160-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-162-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-164-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-166-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-168-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-170-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-172-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-174-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/372-175-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe

pid process

372 82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe

description ioc process

File opened for modification \??\PhysicalDrive0 82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe

Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe

pid	process
372	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
372	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
372	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
372	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
372	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exemsedge.exe

description	pid	process	target process
PID 372 wrote to memory of 1392	372	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe	msedge.exe
PID 372 wrote to memory of 1392	372	82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe	msedge.exe
PID 1392 wrote to memory of 1588	1392	msedge.exe	msedge.exe
PID 1392 wrote to memory of 1588	1392	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe
"C:\Users\Admin\AppData\Local\Temp\82e9ea69607c60c051e492d1443474baa3d1a59d956b0cd6009a67b982258ca8.exe"
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.12345ee.com/
2⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd385246f8,0x7ffd38524708,0x7ffd38524718
3⤵
PID:1588

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CrackCaptchaAPI.dll
Filesize
1.3MB

MD5
9a4965011a94705227f62df0776f2ab6

SHA1
fe91972e1c993731cdacc7429c4f4760672adcf7

SHA256
a9ea79e9c5017616ca9085351ef166f35882ad5a201b92c4839ffdf1169e4113

SHA512
e74bc303d99a2151dd00b8f4da0aabd70b37fe46a74702034a5a0ab3da7cad9ad0b7d69b960a10d0876ad5b660e1b868c8956e8d05321f7120f480baee34378a

Download Submit
memory/372-154-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-136-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-158-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-160-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-138-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-142-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-144-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-146-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-148-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-150-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-152-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-132-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-156-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-134-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-140-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-162-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-164-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-166-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-168-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-170-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-172-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-174-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-175-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/372-133-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1392-177-0x0000000000000000-mapping.dmp

Download
memory/1588-178-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads