43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c

Analysis

max time kernel
40s
max time network
32s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Size

425KB
MD5

53622e58beccc82029353489e3281f50
SHA1

3f1ebe5ca7e439225d4034546c78f7d8aab44281
SHA256

43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c
SHA512

1761e0bc57e25b7374080887f20df226d518beb15e76860009da44b4a9bb7d3dc87ef25e15bb0045a8bdb497b82b1aeb1b399a8e425279fc6aef7968a239160a
SSDEEP

12288:ClvFqXyg8+ZjcXxbHRpdIJNtw/DtJvTvJWhVnXHGl4:c4Cg8fxUNtw/DbvTgPX7

Score

8^/10

bootkit evasion persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2044-57-0x0000000000260000-0x000000000026E000-memory.dmp	upx
behavioral1/memory/2044-59-0x0000000000260000-0x000000000026E000-memory.dmp	upx
behavioral1/memory/2044-62-0x0000000000260000-0x000000000026E000-memory.dmp	upx

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\WINE	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe

Loads dropped DLL 1 IoCs

pid	Process
2044	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\ = "Ehiwe Cezara Ivopane Class"	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\InprocServer32	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\0\win32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\GROOVE.EXE\\14"	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\Version\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\Version\ = "1.0"	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\VersionIndependentProgID\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\ProgID	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\ = "Groove Waffle Type Library 1.0"	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\0\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\FLAGS	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\FLAGS\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\HELPDIR	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\TypeLib\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\Version	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\0	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\InprocServer32\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\EntityPicker.dll"	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\ProgID\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\VersionIndependentProgID\ = "EntityPicker.PropPage1"	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\0\win32	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\TypeLib\ = "{FAD79E56-3A07-5906-9C95-86C8EE4949A4}"	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\"	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\VersionIndependentProgID	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\ProgID\ = "EntityPicker.PropPage1.1"	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\0\win32\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\FLAGS\ = "0"	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FAD79E56-3A07-5906-9C95-86C8EE4949A4}\1.0\HELPDIR\	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9C786DB8-D89C-4F1C-8587-1C800D0B0156}\TypeLib	43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe

C:\Users\Admin\AppData\Local\Temp\43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe
"C:\Users\Admin\AppData\Local\Temp\43d1ad61fc84589858052f5bcc1e1bcc07b434622548f97e295d06655257449c.exe"
1⤵
- Identifies Wine through registry keys
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Modifies registry class
PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\libnspr4.dll

Filesize
10KB

MD5
28a57355d9583b66e51ad978384c159e

SHA1
b8fe4ddb6187cdee0e89c02bab4a104f406d16da

SHA256
81ed76156df0de1caae6730a091f29978493881b54a2d6fbfb43c47153b6fadd

SHA512
991a288ed0f033eb8f54e567a6264a6111f795bd61a1cd600e210730d7ed39c89e735480dc6f0e4026eafad730ae8dc23ec7bc7600a14a2ac9d652638c02ee3e

Download Submit
memory/2044-54-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2044-57-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/2044-58-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/2044-59-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/2044-61-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/2044-62-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/2044-63-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download
memory/2044-64-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/2044-65-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads