ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c

Analysis

max time kernel
161s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe
Size

276KB
MD5

66111f80bfc9d06d631320e3e48864cf
SHA1

d1658966b71e4fb798613151d7d49769f19baa1d
SHA256

ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c
SHA512

f524e5c1856c42862f551978a3399187df3351f48eb87603ac897a231f13029adc0f510ac075150e86daccd18f27d265eefbea679f03eaf390c3ad6d7f6cc038
SSDEEP

6144:WC1lss/k4KCMyMU/gZcHpu4PhDX6tksiRQgZOkpmAAGRn74tHB4EjVNS:ll0e1rCtpN

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/444-141-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/444-143-0x0000000000400000-0x0000000000418000-memory.dmp	upx
behavioral2/memory/444-144-0x0000000000400000-0x0000000000418000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4992 set thread context of 2220	4992	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85
PID 2220 set thread context of 444	2220	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	86

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe
444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe
444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe
444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4992	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe
2220	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 2220	4992	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85
PID 4992 wrote to memory of 2220	4992	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85
PID 4992 wrote to memory of 2220	4992	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85
PID 4992 wrote to memory of 2220	4992	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85
PID 4992 wrote to memory of 2220	4992	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85
PID 4992 wrote to memory of 2220	4992	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85
PID 4992 wrote to memory of 2220	4992	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85
PID 4992 wrote to memory of 2220	4992	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85
PID 2220 wrote to memory of 444	2220	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	86
PID 2220 wrote to memory of 444	2220	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	86
PID 2220 wrote to memory of 444	2220	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	86
PID 2220 wrote to memory of 444	2220	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	86
PID 2220 wrote to memory of 444	2220	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	86
PID 2220 wrote to memory of 444	2220	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	86
PID 2220 wrote to memory of 444	2220	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	86
PID 2220 wrote to memory of 444	2220	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	86
PID 444 wrote to memory of 964	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	45
PID 444 wrote to memory of 964	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	45
PID 444 wrote to memory of 964	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	45
PID 444 wrote to memory of 2448	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	54
PID 444 wrote to memory of 2448	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	54
PID 444 wrote to memory of 2448	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	54
PID 444 wrote to memory of 2468	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	53
PID 444 wrote to memory of 2468	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	53
PID 444 wrote to memory of 2468	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	53
PID 444 wrote to memory of 2780	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	47
PID 444 wrote to memory of 2780	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	47
PID 444 wrote to memory of 2780	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	47
PID 444 wrote to memory of 964	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	45
PID 444 wrote to memory of 964	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	45
PID 444 wrote to memory of 964	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	45
PID 444 wrote to memory of 424	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	44
PID 444 wrote to memory of 424	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	44
PID 444 wrote to memory of 424	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	44
PID 444 wrote to memory of 3260	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	43
PID 444 wrote to memory of 3260	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	43
PID 444 wrote to memory of 3260	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	43
PID 444 wrote to memory of 3372	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	42
PID 444 wrote to memory of 3372	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	42
PID 444 wrote to memory of 3372	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	42
PID 444 wrote to memory of 3452	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	19
PID 444 wrote to memory of 3452	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	19
PID 444 wrote to memory of 3452	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	19
PID 444 wrote to memory of 3532	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	41
PID 444 wrote to memory of 3532	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	41
PID 444 wrote to memory of 3532	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	41
PID 444 wrote to memory of 3784	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	40
PID 444 wrote to memory of 3784	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	40
PID 444 wrote to memory of 3784	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	40
PID 444 wrote to memory of 764	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	21
PID 444 wrote to memory of 764	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	21
PID 444 wrote to memory of 764	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	21
PID 444 wrote to memory of 2700	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	20
PID 444 wrote to memory of 2700	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	20
PID 444 wrote to memory of 2700	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	20
PID 444 wrote to memory of 2340	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	82
PID 444 wrote to memory of 2340	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	82
PID 444 wrote to memory of 2340	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	82
PID 444 wrote to memory of 2220	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85
PID 444 wrote to memory of 2220	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85
PID 444 wrote to memory of 2220	444	ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe	85

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3452

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2700

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:764

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3784

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3532

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3372

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:424

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:964
- C:\Users\Admin\AppData\Local\Temp\ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe
  "C:\Users\Admin\AppData\Local\Temp\ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Users\Admin\AppData\Local\Temp\ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe
    "C:\Users\Admin\AppData\Local\Temp\ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe"
    3⤵
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe
      "C:\Users\Admin\AppData\Local\Temp\ea120f690c239cabc00127591b2c6016f6d77f1ec0902e71292b2fd7320d0e5c.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:444

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2468

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2448

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/444-141-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/444-143-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/444-144-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/964-146-0x000000007FFC0000-0x000000007FFD2000-memory.dmp

Filesize
72KB

Download
memory/964-147-0x000000007FF70000-0x000000007FFB5000-memory.dmp

Filesize
276KB

Download
memory/2220-136-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-145-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2220-176-0x000000007FE30000-0x000000007FE42000-memory.dmp

Filesize
72KB

Download
memory/2220-177-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/4992-132-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download