af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04-12-2022 12:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
Size

328KB
MD5

06ed8a2e45c6671d509fb121373c1c5a
SHA1

c15b2dba8101e2b403747dcb2a3d32d93247f25e
SHA256

af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4
SHA512

82748f444885060d765c244847a255d5d33204be81412eb17e3f8c1ffd1b65468e96a2e707090e561866b0a5a77c21ea983a29fa61a180905130171d6c9ae2bf
SSDEEP

6144:TeXA47CURW+eirtnIwE0XzBTjrBLt4smgZL/Vo2G0E6HxmQC9qO6jW:TeXv7tRWwnIKBTjx6smg5/VK6HTC9qtW

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/976-132-0x0000000000400000-0x00000000004BC000-memory.dmp	upx
behavioral2/memory/976-133-0x0000000000400000-0x00000000004BC000-memory.dmp	upx
behavioral2/memory/976-134-0x0000000000400000-0x00000000004BC000-memory.dmp	upx

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\w:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\x:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\h:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\j:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\q:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\r:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\u:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\e:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\i:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\o:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\s:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\v:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\y:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\f:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\g:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\k:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\m:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\n:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\l:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\p:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\t:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
File opened (read-only)	\??\z:	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe

C:\Users\Admin\AppData\Local\Temp\af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe
"C:\Users\Admin\AppData\Local\Temp\af32c0361bf363687892cd5e40848f558eacc6acf6fba0bbd50e62956d50e0f4.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/976-132-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/976-133-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/976-134-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download