5263af4be4f2250238b25131da6444ba1b6c6ec611833f868c10c14c90350300

Analysis

max time kernel
44s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ͻ/ͻ.exe
Size

1.7MB
MD5

6db57c90bfe524b2d51a3d683d0fb243
SHA1

645bca4f3366f0f9ee3c8a7193775fee890ddb01
SHA256

6f9b54c79ecb40033d31383dafc624ef38c9bcf9d3a510a618ee13675826df69
SHA512

bbe3ed5b6c10a0e48b2d60a6b703642374c74fbc4dc1d9960b428bfcc54b519ec9a4535888999304abf6c9a2cfb0752f0938ec297d7810efc452b05d6d3be403
SSDEEP

49152:md87m0YGyhuCw/coKs16GwbnUfEYKd4u35ea/vydqx8nv5fXALgJo:z7LYeUoKs16zn9YKdl35ea/vydO8nvRk

Score

8^/10

bootkit persistence upx vmprotect

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral7/memory/1292-61-0x0000000000400000-0x00000000006A9000-memory.dmp	upx
behavioral7/memory/1292-63-0x0000000000400000-0x00000000006A9000-memory.dmp	upx

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral7/memory/1292-55-0x0000000002650000-0x000000000281D000-memory.dmp	vmprotect
behavioral7/memory/1292-57-0x0000000002650000-0x000000000281D000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

ͻ.exe

description ioc process

File opened for modification \??\PhysicalDrive0 ͻ.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ͻ.exe

pid process

1292 ͻ.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

ͻ.exe

pid process

1292 ͻ.exe
1292 ͻ.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	ͻ.exe

pid	process
1292	ͻ.exe

pid	process
1292	ͻ.exe
1292	ͻ.exe

C:\Users\Admin\AppData\Local\Temp\ͻ\ͻ.exe
"C:\Users\Admin\AppData\Local\Temp\ͻ\ͻ.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1292

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1292-54-0x00000000762E1000-0x00000000762E3000-memory.dmp

Filesize
8KB

Download
memory/1292-55-0x0000000002650000-0x000000000281D000-memory.dmp

Filesize
1.8MB

Download
memory/1292-57-0x0000000002650000-0x000000000281D000-memory.dmp

Filesize
1.8MB

Download
memory/1292-61-0x0000000000400000-0x00000000006A9000-memory.dmp

Filesize
2.7MB

Download
memory/1292-62-0x0000000002650000-0x000000000281D000-memory.dmp

Filesize
1.8MB

Download
memory/1292-63-0x0000000000400000-0x00000000006A9000-memory.dmp

Filesize
2.7MB

Download