8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91

Analysis

max time kernel
40s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/11/2022, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe
Size

23KB
MD5

39e462a0f75aac9c616f99c305d14ea8
SHA1

94da173f5039938e445fb461f4f22fd99c896349
SHA256

8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91
SHA512

518618eee374f5031d263dc97ba28cb09fee464eca22e5386f60b34f99e6953ace2139b5178767fe900dae58a42482684e5b0bef33c3a7be75559f506150f0e2
SSDEEP

384:p10SiTg/fKwX+5vsKWX5HXsw9edwrCXqOZCgWcruArUMDRJw6FCYlUwc5tblt:p2Sl/fKwX+FiBze+2XtzOiJw6F9lw

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\beep.sys	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe
File opened for modification	C:\Windows\SysWOW64\drivers\beep.sys	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1304-55-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
1304	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1304	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe
1304	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 420	1304	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe	3
PID 1304 wrote to memory of 420	1304	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe	3

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Users\Admin\AppData\Local\Temp\8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe
"C:\Users\Admin\AppData\Local\Temp\8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\dat3E0B.tmp

Filesize
15KB

MD5
7f84c08f681f71005e77cefc5e73de15

SHA1
09c87b84b0c30b383a91614a3b282d180e369c03

SHA256
9126b923abb131a0c1ca0725dcc0b9d5d163db163de413dc7f5032361f655df1

SHA512
d79848fa9c56b1d09cc8a3697ee87b114e4af84d36c62b0ae86de00b142faed8e52a096e5796aaed6fe6fb3a033a5c01dbcdade3c4a1aa9640a4798a1af29c72

Download Submit
memory/1304-55-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1304-56-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download