aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65

General

Target

aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Size

2.9MB
MD5

54cdab164a3f2d41de8de15b042a2e9b
SHA1

4ed8d138bd9dd833344a970c0b839ed7144d2921
SHA256

aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65
SHA512

50ef846ea93a0a027d85621158b5e5f7cf3c72d16616331ef8d86e19d2c96502d8e7722255e2bea0cb4cfa6c063cbc241dcea04449ffe2b5547c9db2449a5bc0
SSDEEP

49152:m3zmDgafPfcAPIdDEDiy88Ej0qN8Vfdc9D+vtnKk1iYSYaLXUZqNL/7F5adkQXKv:m5DEWym0qNEf28tSYaLXyqNLTWkWKmIt

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 28 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2232-59-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-61-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-63-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-65-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-70-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-72-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-74-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-76-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-78-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-80-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-82-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-87-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-84-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-89-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-94-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-96-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-92-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-98-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-100-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-102-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-104-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-106-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-108-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-110-0x0000000003620000-0x0000000003638000-memory.dmp	upx
behavioral1/memory/2232-113-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral1/memory/2232-138-0x0000000003620000-0x0000000003638000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe = "10002"	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe = "10002"	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: 33	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
Token: SeIncBasePriorityPrivilege	2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
2232	aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe

C:\Users\Admin\AppData\Local\Temp\aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe
"C:\Users\Admin\AppData\Local\Temp\aac28e41f79d0282090f13652acf646655e0df0d44016c14e41a3a45908a6f65.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2232-54-0x0000000000400000-0x0000000000E5C61F-memory.dmp

Filesize
10.4MB

Download
memory/2232-55-0x0000000000400000-0x0000000000E5C61F-memory.dmp

Filesize
10.4MB

Download
memory/2232-59-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-61-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-63-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-64-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-65-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-68-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-70-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-72-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-74-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-76-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-78-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-80-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-82-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-85-0x0000000000400000-0x0000000000E5C61F-memory.dmp

Filesize
10.4MB

Download
memory/2232-87-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-84-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-89-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-94-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-96-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-92-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-98-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-100-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-102-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-104-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-106-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-108-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-110-0x0000000003620000-0x0000000003638000-memory.dmp

Filesize
96KB

Download
memory/2232-111-0x0000000035470000-0x0000000035480000-memory.dmp

Filesize
64KB

Download
memory/2232-113-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2232-138-0x0000000003620000-0x0000000003638000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads