ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45

Analysis

max time kernel
154s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 03:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45.exe
Size

1.4MB
MD5

78129222d4b001435c6894a1b37c6f25
SHA1

82a7085bd87f4cf82af5f44e8168f850cab924a1
SHA256

ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45
SHA512

a9e0e83776ad788c419471f2402f7470d15e6e1b6dd14987af0d18c18002d0cf4aa128b3350b0ec9795c6f03a50e38298b2921fb6950bc3098fba564655c9bc4
SSDEEP

24576:E9E0Y66AFVTZFJrns+uhMaq6HGdrqCFHMs8LHorhCVd1s/tIkfYaQnN7:ETY66Szs+ueR6HSrtFMsTSw/tIkPQnN7

Score

8^/10

bootkit persistence vmprotect

Malware Config

Signatures

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1152-133-0x0000000000400000-0x00000000006D8000-memory.dmp	vmprotect
behavioral2/memory/1152-134-0x0000000000400000-0x00000000006D8000-memory.dmp	vmprotect
behavioral2/memory/1152-137-0x0000000000400000-0x00000000006D8000-memory.dmp	vmprotect
behavioral2/memory/1152-138-0x0000000000400000-0x00000000006D8000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
4568	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1152	ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45.exe
1152	ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1152	ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45.exe
1152	ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4568	1152	ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45.exe	79
PID 1152 wrote to memory of 4568	1152	ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45.exe	79
PID 1152 wrote to memory of 4568	1152	ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45.exe	79

C:\Users\Admin\AppData\Local\Temp\ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45.exe
"C:\Users\Admin\AppData\Local\Temp\ed76f7b6ce222514f2ed743a0028b63102026c8ddc61eeb1ff16d6fcf50edb45.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:4568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-133-0x0000000000400000-0x00000000006D8000-memory.dmp

Filesize
2.8MB

Download
memory/1152-134-0x0000000000400000-0x00000000006D8000-memory.dmp

Filesize
2.8MB

Download
memory/1152-137-0x0000000000400000-0x00000000006D8000-memory.dmp

Filesize
2.8MB

Download
memory/1152-138-0x0000000000400000-0x00000000006D8000-memory.dmp

Filesize
2.8MB

Download