9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c

Analysis

max time kernel
59s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 09:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe
Size

268KB
MD5

64fe22577fa976e2d42d122a04a74553
SHA1

b82d473befb2d938ed1e93b179030d2e23a00c16
SHA256

9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c
SHA512

dedee7831a277f7a46f906d7cb5d4e6af6add5b5b6abaa697440beb57123aa58663f4cf56cd6c6cc953809db3299f04473f167aa8655f9966222416633c3598a
SSDEEP

3072:vwVIvoOqzSaoV9K9QO17bPFcpDuBplAa+0GgPvD1FzfwVYZODFZaFFw811Cx2w:PoCQ4DAp2a+ZgPJFzfq2OD7/Aoxh

Score

8^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2168-103-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2168-105-0x0000000010000000-0x000000001004D000-memory.dmp	upx
behavioral1/memory/2168-106-0x0000000010000000-0x000000001004D000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 704 set thread context of 1476	704	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	27
PID 1476 set thread context of 2168	1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	28

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
704	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe
1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe
1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe
1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe
1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
704	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe
1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 704 wrote to memory of 1476	704	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	27
PID 704 wrote to memory of 1476	704	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	27
PID 704 wrote to memory of 1476	704	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	27
PID 704 wrote to memory of 1476	704	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	27
PID 704 wrote to memory of 1476	704	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	27
PID 704 wrote to memory of 1476	704	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	27
PID 704 wrote to memory of 1476	704	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	27
PID 704 wrote to memory of 1476	704	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	27
PID 1476 wrote to memory of 2168	1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	28
PID 1476 wrote to memory of 2168	1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	28
PID 1476 wrote to memory of 2168	1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	28
PID 1476 wrote to memory of 2168	1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	28
PID 1476 wrote to memory of 2168	1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	28
PID 1476 wrote to memory of 2168	1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	28
PID 1476 wrote to memory of 2168	1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	28
PID 1476 wrote to memory of 2168	1476	9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe	28

C:\Users\Admin\AppData\Local\Temp\9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe
"C:\Users\Admin\AppData\Local\Temp\9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:704
- C:\Users\Admin\AppData\Local\Temp\9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe
  C:\Users\Admin\AppData\Local\Temp\9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Users\Admin\AppData\Local\Temp\9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe
    C:\Users\Admin\AppData\Local\Temp\9354661c3f9559fa7ae07649a00c3f8682c9d7e0187c3daf24b570dab2930f9c.exe
    3⤵
    PID:2168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1476-84-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/1476-72-0x0000000000240000-0x000000000025E000-memory.dmp

Filesize
120KB

Download
memory/1476-59-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1476-61-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1476-64-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1476-65-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1476-68-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1476-69-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/1476-70-0x0000000000240000-0x000000000024C000-memory.dmp

Filesize
48KB

Download
memory/1476-71-0x0000000000240000-0x000000000024C000-memory.dmp

Filesize
48KB

Download
memory/1476-73-0x0000000000240000-0x000000000024E000-memory.dmp

Filesize
56KB

Download
memory/1476-83-0x0000000000240000-0x0000000000242000-memory.dmp

Filesize
8KB

Download
memory/1476-74-0x0000000000240000-0x000000000024E000-memory.dmp

Filesize
56KB

Download
memory/1476-75-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/1476-76-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/1476-77-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/1476-78-0x0000000000240000-0x0000000000263000-memory.dmp

Filesize
140KB

Download
memory/1476-79-0x0000000000240000-0x000000000024E000-memory.dmp

Filesize
56KB

Download
memory/1476-80-0x0000000000240000-0x0000000000259000-memory.dmp

Filesize
100KB

Download
memory/1476-81-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/1476-82-0x0000000000240000-0x0000000000249000-memory.dmp

Filesize
36KB

Download
memory/1476-57-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1476-56-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1476-92-0x0000000000240000-0x0000000000264000-memory.dmp

Filesize
144KB

Download
memory/1476-86-0x0000000000240000-0x0000000000255000-memory.dmp

Filesize
84KB

Download
memory/1476-87-0x0000000000240000-0x0000000000258000-memory.dmp

Filesize
96KB

Download
memory/1476-88-0x0000000002500000-0x00000000025C9000-memory.dmp

Filesize
804KB

Download
memory/1476-89-0x0000000000240000-0x000000000025E000-memory.dmp

Filesize
120KB

Download
memory/1476-90-0x0000000000240000-0x000000000026D000-memory.dmp

Filesize
180KB

Download
memory/1476-91-0x0000000000240000-0x000000000028D000-memory.dmp

Filesize
308KB

Download
memory/1476-85-0x0000000000240000-0x000000000024D000-memory.dmp

Filesize
52KB

Download
memory/1476-93-0x0000000000240000-0x00000000002E6000-memory.dmp

Filesize
664KB

Download
memory/1476-94-0x0000000000240000-0x000000000024B000-memory.dmp

Filesize
44KB

Download
memory/1476-95-0x0000000000240000-0x0000000000271000-memory.dmp

Filesize
196KB

Download
memory/1476-96-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1476-97-0x0000000000240000-0x0000000000252000-memory.dmp

Filesize
72KB

Download
memory/1476-98-0x0000000000240000-0x00000000002AB000-memory.dmp

Filesize
428KB

Download
memory/1476-99-0x0000000000240000-0x00000000002D9000-memory.dmp

Filesize
612KB

Download
memory/1476-100-0x0000000000240000-0x00000000002B1000-memory.dmp

Filesize
452KB

Download
memory/1476-101-0x0000000000240000-0x0000000000248000-memory.dmp

Filesize
32KB

Download
memory/1476-109-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/1476-108-0x0000000000400000-0x0000000000453000-memory.dmp

Filesize
332KB

Download
memory/2168-106-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2168-105-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download
memory/2168-103-0x0000000010000000-0x000000001004D000-memory.dmp

Filesize
308KB

Download