9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

Analysis

max time kernel
179s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
05/12/2022, 06:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207.exe
Size

20KB
MD5

1208531de08e2cc108ea9dc2b02a8e40
SHA1

6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55
SHA256

9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207
SHA512

60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5
SSDEEP

384:Gz4PQJ55g8SYRsqNvSEB4c3rlx680RQdW2YAaBRRLTAltjFRgxwskxl:Gz1FFScHNqI/680RQMCaBIPawnxl

Score

8^/10

bootkit persistence

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
4980	Admin.exe
4920	Admin.exe
4876	Admin.exe
924	Admin.exe
2196	Admin.exe
4996	Admin.exe
4620	Admin.exe
1924	Admin.exe
3388	Admin.exe
3916	Admin.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe /i"	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe /i"	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe /i"	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe /i"	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe /i"	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe /i"	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe /i"	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe /i"	Admin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe /i"	9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Admin = "C:\\Users\\Admin\\Admin.exe /i"	Admin.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Admin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
424	9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207.exe
424	9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207.exe
4980	Admin.exe
4980	Admin.exe
4920	Admin.exe
4920	Admin.exe
4876	Admin.exe
4876	Admin.exe
924	Admin.exe
924	Admin.exe
2196	Admin.exe
2196	Admin.exe
4996	Admin.exe
4996	Admin.exe
4620	Admin.exe
4620	Admin.exe
1924	Admin.exe
1924	Admin.exe
3388	Admin.exe
3388	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe
3916	Admin.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 2872	424	9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207.exe	46
PID 424 wrote to memory of 4980	424	9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207.exe	81
PID 424 wrote to memory of 4980	424	9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207.exe	81
PID 424 wrote to memory of 4980	424	9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207.exe	81
PID 4980 wrote to memory of 2920	4980	Admin.exe	71
PID 4980 wrote to memory of 4920	4980	Admin.exe	82
PID 4980 wrote to memory of 4920	4980	Admin.exe	82
PID 4980 wrote to memory of 4920	4980	Admin.exe	82
PID 4920 wrote to memory of 2960	4920	Admin.exe	70
PID 4920 wrote to memory of 4876	4920	Admin.exe	83
PID 4920 wrote to memory of 4876	4920	Admin.exe	83
PID 4920 wrote to memory of 4876	4920	Admin.exe	83
PID 4876 wrote to memory of 3104	4876	Admin.exe	66
PID 4876 wrote to memory of 924	4876	Admin.exe	84
PID 4876 wrote to memory of 924	4876	Admin.exe	84
PID 4876 wrote to memory of 924	4876	Admin.exe	84
PID 924 wrote to memory of 3304	924	Admin.exe	62
PID 924 wrote to memory of 2196	924	Admin.exe	85
PID 924 wrote to memory of 2196	924	Admin.exe	85
PID 924 wrote to memory of 2196	924	Admin.exe	85
PID 2196 wrote to memory of 3404	2196	Admin.exe	61
PID 2196 wrote to memory of 4996	2196	Admin.exe	86
PID 2196 wrote to memory of 4996	2196	Admin.exe	86
PID 2196 wrote to memory of 4996	2196	Admin.exe	86
PID 4996 wrote to memory of 3476	4996	Admin.exe	48
PID 4996 wrote to memory of 4620	4996	Admin.exe	87
PID 4996 wrote to memory of 4620	4996	Admin.exe	87
PID 4996 wrote to memory of 4620	4996	Admin.exe	87
PID 4620 wrote to memory of 3568	4620	Admin.exe	60
PID 4620 wrote to memory of 1924	4620	Admin.exe	88
PID 4620 wrote to memory of 1924	4620	Admin.exe	88
PID 4620 wrote to memory of 1924	4620	Admin.exe	88
PID 1924 wrote to memory of 3820	1924	Admin.exe	53
PID 1924 wrote to memory of 3388	1924	Admin.exe	89
PID 1924 wrote to memory of 3388	1924	Admin.exe	89
PID 1924 wrote to memory of 3388	1924	Admin.exe	89
PID 3388 wrote to memory of 4692	3388	Admin.exe	51
PID 3388 wrote to memory of 3916	3388	Admin.exe	90
PID 3388 wrote to memory of 3916	3388	Admin.exe	90
PID 3388 wrote to memory of 3916	3388	Admin.exe	90

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2872

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3476

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4692

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3820

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3568

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3404

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3104

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2920

C:\Users\Admin\AppData\Local\Temp\9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207.exe
"C:\Users\Admin\AppData\Local\Temp\9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:424
- C:\Users\Admin\Admin.exe
  C:\Users\Admin\Admin.exe /r
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Users\Admin\Admin.exe
    C:\Users\Admin\Admin.exe /r
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4920
  - - C:\Users\Admin\Admin.exe
      C:\Users\Admin\Admin.exe /r
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4876
    - - C:\Users\Admin\Admin.exe
        
        C:\Users\Admin\Admin.exe /r
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:924
      - C:\Users\Admin\Admin.exe
        
        C:\Users\Admin\Admin.exe /r
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2196
        
        C:\Users\Admin\Admin.exe
        
        C:\Users\Admin\Admin.exe /r
        7⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Users\Admin\Admin.exe
        
        C:\Users\Admin\Admin.exe /r
        8⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Users\Admin\Admin.exe
        
        C:\Users\Admin\Admin.exe /r
        9⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Users\Admin\Admin.exe
        
        C:\Users\Admin\Admin.exe /r
        10⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Users\Admin\Admin.exe
        
        C:\Users\Admin\Admin.exe /r
        11⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Suspicious behavior: EnumeratesProcesses
        
        PID:3916

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Admin.exe

Filesize
20KB

MD5
1208531de08e2cc108ea9dc2b02a8e40

SHA1
6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55

SHA256
9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

SHA512
60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5

Download Submit
C:\Users\Admin\Admin.exe

Filesize
20KB

MD5
1208531de08e2cc108ea9dc2b02a8e40

SHA1
6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55

SHA256
9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

SHA512
60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5

Download Submit
C:\Users\Admin\Admin.exe

Filesize
20KB

MD5
1208531de08e2cc108ea9dc2b02a8e40

SHA1
6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55

SHA256
9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

SHA512
60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5

Download Submit
C:\Users\Admin\Admin.exe

Filesize
20KB

MD5
1208531de08e2cc108ea9dc2b02a8e40

SHA1
6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55

SHA256
9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

SHA512
60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5

Download Submit
C:\Users\Admin\Admin.exe

Filesize
20KB

MD5
1208531de08e2cc108ea9dc2b02a8e40

SHA1
6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55

SHA256
9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

SHA512
60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5

Download Submit
C:\Users\Admin\Admin.exe

Filesize
20KB

MD5
1208531de08e2cc108ea9dc2b02a8e40

SHA1
6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55

SHA256
9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

SHA512
60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5

Download Submit
C:\Users\Admin\Admin.exe

Filesize
20KB

MD5
1208531de08e2cc108ea9dc2b02a8e40

SHA1
6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55

SHA256
9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

SHA512
60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5

Download Submit
C:\Users\Admin\Admin.exe

Filesize
20KB

MD5
1208531de08e2cc108ea9dc2b02a8e40

SHA1
6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55

SHA256
9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

SHA512
60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5

Download Submit
C:\Users\Admin\Admin.exe

Filesize
20KB

MD5
1208531de08e2cc108ea9dc2b02a8e40

SHA1
6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55

SHA256
9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

SHA512
60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5

Download Submit
C:\Users\Admin\Admin.exe

Filesize
20KB

MD5
1208531de08e2cc108ea9dc2b02a8e40

SHA1
6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55

SHA256
9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

SHA512
60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5

Download Submit
C:\Users\Admin\Admin.exe

Filesize
20KB

MD5
1208531de08e2cc108ea9dc2b02a8e40

SHA1
6f7c48c22a1d310912fe9cdc9690c2ef1ad82d55

SHA256
9b52b43aee2258bcfce7410714955a4846cf6148b9c420a8deb797d792ae8207

SHA512
60a7968fa1065fe5d70d2c7f721dc54d5885b829f315287378a341d4dcdaaf16eb51d3a53113693667f46a64f218dcff132e9bd495caffeb3f59f2237ba155b5

Download Submit
memory/424-135-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download
memory/924-145-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download
memory/1924-157-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download
memory/2196-148-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download
memory/3388-160-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download
memory/3916-163-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download
memory/4620-154-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download
memory/4876-142-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download
memory/4920-139-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download
memory/4980-136-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download
memory/4996-151-0x0000000008000000-0x0000000008008000-memory.dmp

Filesize
32KB

Download