ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c

Analysis

max time kernel
47s
max time network
52s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe
Size

164KB
MD5

3125224496a4396b708e0b00eda95ad4
SHA1

8eacac197b5fb24f5eb6049bc07996830ec79f38
SHA256

ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c
SHA512

81f6aab0bd16845b0e4359f8c78434f893e9ad40512c2020464e3ad733593358501abb659ab92bf80d0875bbd814bdc855748a54c6773b62258fae8a3554e057
SSDEEP

3072:Ye2iWv0RD7L4IDnkHxbuhA3KU2i8cZUrj3hTS:Ye2iI0RDX4IaoAd2i8brj3ZS

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1936-66-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1936-68-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1936-69-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1936-72-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/1936-73-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1060 set thread context of 1188	1060	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27
PID 1188 set thread context of 1936	1188	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe
1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1188	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 1188	1060	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27
PID 1060 wrote to memory of 1188	1060	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27
PID 1060 wrote to memory of 1188	1060	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27
PID 1060 wrote to memory of 1188	1060	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27
PID 1060 wrote to memory of 1188	1060	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27
PID 1060 wrote to memory of 1188	1060	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27
PID 1060 wrote to memory of 1188	1060	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27
PID 1060 wrote to memory of 1188	1060	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27
PID 1188 wrote to memory of 1936	1188	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	28
PID 1188 wrote to memory of 1936	1188	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	28
PID 1188 wrote to memory of 1936	1188	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	28
PID 1188 wrote to memory of 1936	1188	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	28
PID 1188 wrote to memory of 1936	1188	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	28
PID 1188 wrote to memory of 1936	1188	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	28
PID 1188 wrote to memory of 1936	1188	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	28
PID 1188 wrote to memory of 1936	1188	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	28
PID 1936 wrote to memory of 1284	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	12
PID 1936 wrote to memory of 1284	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	12
PID 1936 wrote to memory of 1284	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	12
PID 1936 wrote to memory of 1160	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	14
PID 1936 wrote to memory of 1160	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	14
PID 1936 wrote to memory of 1160	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	14
PID 1936 wrote to memory of 1244	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	13
PID 1936 wrote to memory of 1244	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	13
PID 1936 wrote to memory of 1244	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	13
PID 1936 wrote to memory of 1284	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	12
PID 1936 wrote to memory of 1284	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	12
PID 1936 wrote to memory of 1284	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	12
PID 1936 wrote to memory of 1188	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27
PID 1936 wrote to memory of 1188	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27
PID 1936 wrote to memory of 1188	1936	ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe	27

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1284
- C:\Users\Admin\AppData\Local\Temp\ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe
  "C:\Users\Admin\AppData\Local\Temp\ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Users\Admin\AppData\Local\Temp\ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe
    "C:\Users\Admin\AppData\Local\Temp\ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Users\Admin\AppData\Local\Temp\ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe
      "C:\Users\Admin\AppData\Local\Temp\ffadc595e2eef045d76ad97944b2daa457a9db893cd7c471167e83e50d1e352c.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1936

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1244

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1188-55-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1188-57-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1188-60-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1188-54-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1188-77-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1284-74-0x000000007EFC0000-0x000000007EFD1000-memory.dmp

Filesize
68KB

Download
memory/1284-78-0x000000007EF90000-0x000000007EFBA000-memory.dmp

Filesize
168KB

Download
memory/1936-66-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1936-72-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1936-73-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1936-69-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1936-68-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1936-65-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download