30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe
Size

7.9MB
MD5

9b96eb268d1961497d3a3d30c23ebe8e
SHA1

c249ac9b9d468122de6d23eae7880cb070439828
SHA256

30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418
SHA512

b7d7340b45752b303b70af0dd15af65ae3f9f7cec2da2b0c39b712ccafbf7fd93fa42b61cbbbb6d4be319052b1ec3593af4620d8d94dfcfe5b3c8ee60cb3690a
SSDEEP

98304:i8nVfeyNeb9WaGePw94uVS9cUQ8ia8ktR2CfJNaaDnY5X9HV2G0a:dCbMak4KVq8ktR2CfnaaDSNHVF9

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1868-0-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-1-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-3-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-5-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-7-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-9-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-18-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-16-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-22-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-24-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-28-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-26-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-20-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-30-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-14-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-12-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-2-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-33-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-35-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-38-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-40-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-44-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-47-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-42-0x0000000010000000-0x000000001003F000-memory.dmp	upx
behavioral1/memory/1868-60-0x0000000010000000-0x000000001003F000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3000	1868	WerFault.exe	27

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1868	30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1868	30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe
1868	30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe
1868	30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1868 wrote to memory of 3000	1868	30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe	28
PID 1868 wrote to memory of 3000	1868	30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe	28
PID 1868 wrote to memory of 3000	1868	30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe	28
PID 1868 wrote to memory of 3000	1868	30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe	28

C:\Users\Admin\AppData\Local\Temp\30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe
"C:\Users\Admin\AppData\Local\Temp\30ef1a51764ce81f581fd4dcfbbf517d9cfbadf88d5038cd2a6872ed218da418.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 464
  2⤵
  - Program crash
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1868-0-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-1-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-3-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-5-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-7-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-9-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-18-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-16-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-22-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-24-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-28-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-26-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-20-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-30-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-14-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-12-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-2-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-33-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-35-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-38-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-40-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-44-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-47-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-42-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-48-0x0000000000F20000-0x0000000000F56000-memory.dmp

Filesize
216KB

Download
memory/1868-51-0x0000000003810000-0x0000000003CD2000-memory.dmp

Filesize
4.8MB

Download
memory/1868-56-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1868-55-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1868-57-0x0000000076400000-0x0000000076510000-memory.dmp

Filesize
1.1MB

Download
memory/1868-58-0x0000000003810000-0x0000000003CD2000-memory.dmp

Filesize
4.8MB

Download
memory/1868-59-0x0000000003810000-0x0000000003CD2000-memory.dmp

Filesize
4.8MB

Download
memory/1868-60-0x0000000010000000-0x000000001003F000-memory.dmp

Filesize
252KB

Download
memory/1868-61-0x0000000003CE0000-0x00000000044FB000-memory.dmp

Filesize
8.1MB

Download
memory/1868-62-0x0000000004500000-0x0000000004DFA000-memory.dmp

Filesize
9.0MB

Download
memory/1868-63-0x0000000000D30000-0x0000000000D32000-memory.dmp

Filesize
8KB

Download
memory/1868-64-0x00000000028A0000-0x00000000028B6000-memory.dmp

Filesize
88KB

Download
memory/1868-65-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Filesize
4KB

Download
memory/1868-66-0x0000000076400000-0x0000000076510000-memory.dmp

Filesize
1.1MB

Download
memory/1868-67-0x0000000002DE0000-0x0000000002DEA000-memory.dmp

Filesize
40KB

Download
memory/1868-68-0x0000000002DE0000-0x0000000002DEA000-memory.dmp

Filesize
40KB

Download
memory/1868-69-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/1868-70-0x0000000003810000-0x0000000003CD2000-memory.dmp

Filesize
4.8MB

Download
memory/1868-71-0x0000000076400000-0x0000000076510000-memory.dmp

Filesize
1.1MB

Download
memory/1868-72-0x0000000003CE0000-0x00000000044FB000-memory.dmp

Filesize
8.1MB

Download
memory/1868-73-0x0000000004500000-0x0000000004DFA000-memory.dmp

Filesize
9.0MB

Download
memory/1868-74-0x00000000028A0000-0x00000000028B6000-memory.dmp

Filesize
88KB

Download
memory/1868-75-0x0000000076400000-0x0000000076510000-memory.dmp

Filesize
1.1MB

Download
memory/1868-76-0x0000000002DE0000-0x0000000002DEA000-memory.dmp

Filesize
40KB

Download
memory/1868-77-0x0000000002DE0000-0x0000000002DEA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads