9aba0637681a763ea20ec6f710d07a693e6bfa883b527f5267a1b0e730de24de

Analysis

max time kernel
163s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9aba0637681a763ea20ec6f710d07a693e6bfa883b527f5267a1b0e730de24de.exe
Size

147KB
MD5

0705e26331ee3f9e3c22bec68a782510
SHA1

0ecfe1e325eecd465d94279a62989ff2a0f6380d
SHA256

9aba0637681a763ea20ec6f710d07a693e6bfa883b527f5267a1b0e730de24de
SHA512

c1572296c0e14b528a58eca80f0bfe90ecb7b869dc6d069eec178aecaa8d5bdab530ad12f7130660fc3fdda5329f872bf061a11ba801695c693e1f24094cefd3
SSDEEP

3072:Rdc+4sSMwDBndbLEvqX8epy20tzbl4r5mvQnqeH:f4QwDBdvEvYtpcfi7qy

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\physicaldrive0	9aba0637681a763ea20ec6f710d07a693e6bfa883b527f5267a1b0e730de24de.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4980	9aba0637681a763ea20ec6f710d07a693e6bfa883b527f5267a1b0e730de24de.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4980	9aba0637681a763ea20ec6f710d07a693e6bfa883b527f5267a1b0e730de24de.exe

C:\Users\Admin\AppData\Local\Temp\9aba0637681a763ea20ec6f710d07a693e6bfa883b527f5267a1b0e730de24de.exe
"C:\Users\Admin\AppData\Local\Temp\9aba0637681a763ea20ec6f710d07a693e6bfa883b527f5267a1b0e730de24de.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:4980

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {B155BDF8-02F0-451E-9A26-AE317CFD7779} /I {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} /X 0x401
1⤵
PID:2224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4980-132-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/4980-133-0x0000000000A80000-0x0000000000AA3000-memory.dmp

Filesize
140KB

Download
memory/4980-134-0x0000000000A80000-0x0000000000AA3000-memory.dmp

Filesize
140KB

Download
memory/4980-135-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download