8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91

Analysis

max time kernel
102s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe
Size

23KB
MD5

39e462a0f75aac9c616f99c305d14ea8
SHA1

94da173f5039938e445fb461f4f22fd99c896349
SHA256

8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91
SHA512

518618eee374f5031d263dc97ba28cb09fee464eca22e5386f60b34f99e6953ace2139b5178767fe900dae58a42482684e5b0bef33c3a7be75559f506150f0e2
SSDEEP

384:p10SiTg/fKwX+5vsKWX5HXsw9edwrCXqOZCgWcruArUMDRJw6FCYlUwc5tblt:p2Sl/fKwX+FiBze+2XtzOiJw6F9lw

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\beep.sys	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe
File opened for modification	C:\Windows\SysWOW64\drivers\beep.sys	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2500-132-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2500-133-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral2/memory/2500-136-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Loads dropped DLL 1 IoCs

pid	Process
2500	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2500	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe
2500	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe
2500	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe
2500	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
652	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 580	2500	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe	3
PID 2500 wrote to memory of 580	2500	8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe	3

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:580

C:\Users\Admin\AppData\Local\Temp\8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe
"C:\Users\Admin\AppData\Local\Temp\8f84316e002bf747ee6931728e5c69e8383bd56d55811ad85a5bad3d5cb7bc91.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dat55B1.tmp

Filesize
15KB

MD5
7f84c08f681f71005e77cefc5e73de15

SHA1
09c87b84b0c30b383a91614a3b282d180e369c03

SHA256
9126b923abb131a0c1ca0725dcc0b9d5d163db163de413dc7f5032361f655df1

SHA512
d79848fa9c56b1d09cc8a3697ee87b114e4af84d36c62b0ae86de00b142faed8e52a096e5796aaed6fe6fb3a033a5c01dbcdade3c4a1aa9640a4798a1af29c72

Download Submit
memory/2500-132-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2500-133-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2500-135-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download
memory/2500-136-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2500-137-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download