a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657

General

Target

a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe
Size

426KB
MD5

d104ed6809cccf794135204478f634c2
SHA1

e05a1cdc30127dd38be0db9afe5828c0f91d99c2
SHA256

a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657
SHA512

9ef7b8fa820073dbe208bde9742395e8e660b0313cab137e898d4cc52dec0103b6ca0da76a248363690e96de3a768589ea235840886baccf1dc9a4da697013dd
SSDEEP

6144:SDhCdYx7WL5dNy0uewsL5iOjA+/g/vfV4xjhuoNiYQSRgJ7Ui71bhzYof:S8k7hZoL5iB+/g/VOsoxQ+871bR

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

a26Tj8V6.exebob.exeboc.exe

pid process

4208 a26Tj8V6.exe
4992 bob.exe
5008 boc.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

bob.exe

description ioc process

File opened for modification \??\physicaldrive0 bob.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

a26Tj8V6.exe

pid process

4208 a26Tj8V6.exe
4208 a26Tj8V6.exe
4208 a26Tj8V6.exe
4208 a26Tj8V6.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bob.exe

description pid process

Token: SeShutdownPrivilege 4992 bob.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

a26Tj8V6.exe

pid process

4208 a26Tj8V6.exe

pid	process
4208	a26Tj8V6.exe
4992	bob.exe
5008	boc.exe

description	ioc	process
File opened for modification	\??\physicaldrive0	bob.exe

pid	process
4208	a26Tj8V6.exe
4208	a26Tj8V6.exe
4208	a26Tj8V6.exe
4208	a26Tj8V6.exe

description	pid	process
Token: SeShutdownPrivilege	4992	bob.exe

pid	process
4208	a26Tj8V6.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe

description	pid	process	target process
PID 1156 wrote to memory of 4208	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	a26Tj8V6.exe
PID 1156 wrote to memory of 4208	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	a26Tj8V6.exe
PID 1156 wrote to memory of 4208	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	a26Tj8V6.exe
PID 1156 wrote to memory of 4992	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	bob.exe
PID 1156 wrote to memory of 4992	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	bob.exe
PID 1156 wrote to memory of 4992	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	bob.exe
PID 1156 wrote to memory of 5008	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	boc.exe
PID 1156 wrote to memory of 5008	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	boc.exe
PID 1156 wrote to memory of 5008	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	boc.exe
PID 1156 wrote to memory of 4076	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	cmd.exe
PID 1156 wrote to memory of 4076	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	cmd.exe
PID 1156 wrote to memory of 4076	1156	a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe
"C:\Users\Admin\AppData\Local\Temp\a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Users\Admin\a26Tj8V6.exe
a26Tj8V6.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4208

C:\Users\Admin\bob.exe
bob.exe
2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
PID:4992

C:\Users\Admin\boc.exe
boc.exe
2⤵
- Executes dropped EXE
PID:5008

C:\Windows\SysWOW64\cmd.exe
cmd /c del a7fd07dc0abb12be563200627164211884534fda523606ac5eb17572f64b3657.exe
2⤵
PID:4076

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\a26Tj8V6.exe
Filesize
152KB

MD5
8cc33bea0a846510b2f0d0d7b350c564

SHA1
115b10b8717ebabf66c358fd72b7709316e9a1dc

SHA256
11d7b9cc464608898d69168dcd6f377b7fcb1c95083c6603e5dc45db2f4e423e

SHA512
fcd4050fd2b42ec58f7a6a4d612e1186a02265d2da50d13ac70489cf714de066cf1b121157b6c3f616251bb629436f3a45b9fd1f65e8228188a09b9feb3b5bfd

Download Submit
C:\Users\Admin\a26Tj8V6.exe
Filesize
152KB

MD5
8cc33bea0a846510b2f0d0d7b350c564

SHA1
115b10b8717ebabf66c358fd72b7709316e9a1dc

SHA256
11d7b9cc464608898d69168dcd6f377b7fcb1c95083c6603e5dc45db2f4e423e

SHA512
fcd4050fd2b42ec58f7a6a4d612e1186a02265d2da50d13ac70489cf714de066cf1b121157b6c3f616251bb629436f3a45b9fd1f65e8228188a09b9feb3b5bfd

Download Submit
C:\Users\Admin\bob.exe
Filesize
223KB

MD5
7f0f3f5ade2f14700f469d77142d2cc0

SHA1
4adbd5775ffc9b200d4c801b166476d1ddc1f7d6

SHA256
f9c16abdffcf75ffec12e4d244f811f568764731260e5d2ff08deecd514c1f89

SHA512
fe669cf66683935751c6df4321caf9c14efe82365a4fb3aa81e2293d00d6cb825812339d394706161e948482f619628a2e9a3db1c02960172773c8757315136c

Download Submit
C:\Users\Admin\bob.exe
Filesize
223KB

MD5
7f0f3f5ade2f14700f469d77142d2cc0

SHA1
4adbd5775ffc9b200d4c801b166476d1ddc1f7d6

SHA256
f9c16abdffcf75ffec12e4d244f811f568764731260e5d2ff08deecd514c1f89

SHA512
fe669cf66683935751c6df4321caf9c14efe82365a4fb3aa81e2293d00d6cb825812339d394706161e948482f619628a2e9a3db1c02960172773c8757315136c

Download Submit
C:\Users\Admin\boc.exe
Filesize
148KB

MD5
ddecfba8af9f77d9f872d36860b7ef8d

SHA1
7f85f3433bcd538337bf7c41668aee9a7b005fcb

SHA256
0c9b8ea62805169b46d5cfe06c2b402a54658577a272269279976f5cc3fdf6a4

SHA512
4ab4f7c8eebe16f6e97b1121f9bef9e82a01d1079a04eb52ede4aeafb4fa7431a0861c0ce3f4f389bef0ba35090eef2f21b50712dba34dd66fa51f7d7f9371ca

Download Submit
C:\Users\Admin\boc.exe
Filesize
148KB

MD5
ddecfba8af9f77d9f872d36860b7ef8d

SHA1
7f85f3433bcd538337bf7c41668aee9a7b005fcb

SHA256
0c9b8ea62805169b46d5cfe06c2b402a54658577a272269279976f5cc3fdf6a4

SHA512
4ab4f7c8eebe16f6e97b1121f9bef9e82a01d1079a04eb52ede4aeafb4fa7431a0861c0ce3f4f389bef0ba35090eef2f21b50712dba34dd66fa51f7d7f9371ca

Download Submit
memory/4076-144-0x0000000000000000-mapping.dmp

Download
memory/4208-132-0x0000000000000000-mapping.dmp

Download
memory/4992-141-0x00000000023D0000-0x0000000002434000-memory.dmp

Filesize
400KB

Download
memory/4992-143-0x00000000023D0000-0x0000000002434000-memory.dmp

Filesize
400KB

Download
memory/4992-142-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4992-135-0x0000000000000000-mapping.dmp

Download
memory/4992-147-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5008-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing