ada4f1a06dc91b59c49c1c6cccd47897a229a13a87855435d039ba192572254b

Analysis

max time kernel
142s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c42588953b8e76a5e50c7b95636398c.exe
Size

202KB
MD5

0c42588953b8e76a5e50c7b95636398c
SHA1

8e283c8079e73e6deebdad0762814da098a0b2c7
SHA256

ada4f1a06dc91b59c49c1c6cccd47897a229a13a87855435d039ba192572254b
SHA512

2b1338f1f4848872af6e8673ed1d24d617ccdbc13afdb55197672fdc37f39f59f0f75db1b597900e5869c3b1ad9d26ef41668bb05b3d7ccd21506822dbbbc2fe
SSDEEP

6144:dHCTecfxmJ5TINDYwUi+pLTAxxNMIeh/Bpl8:5GxG5To8wUi4cxJehm

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1924-0-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/1924-17-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/1924-18-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/1924-22-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/1924-23-0x0000000000400000-0x0000000000477000-memory.dmp	upx
behavioral1/memory/1924-29-0x0000000000400000-0x0000000000477000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\p:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\q:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\n:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\o:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\t:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\j:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\r:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\s:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\u:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\w:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\e:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\h:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\i:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\x:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\z:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\v:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\y:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\g:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\k:	0c42588953b8e76a5e50c7b95636398c.exe
File opened (read-only)	\??\l:	0c42588953b8e76a5e50c7b95636398c.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	0c42588953b8e76a5e50c7b95636398c.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SAItest.txt	0c42588953b8e76a5e50c7b95636398c.exe

C:\Users\Admin\AppData\Local\Temp\0c42588953b8e76a5e50c7b95636398c.exe
"C:\Users\Admin\AppData\Local\Temp\0c42588953b8e76a5e50c7b95636398c.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
PID:1924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1924-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1924-17-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1924-18-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1924-22-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1924-23-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1924-29-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads