cf329679c44c6f3ec8f74c6a9ff8f2ba1320ce2bbf2a2a6a68d740e54ea73c3d

Analysis

max time kernel
146s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
01/01/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3d2b8894990faaae5eee131f689a7ad3.exe
Size

543KB
MD5

3d2b8894990faaae5eee131f689a7ad3
SHA1

18ecb59e16293be6d46967ac3eef8149dcec476b
SHA256

cf329679c44c6f3ec8f74c6a9ff8f2ba1320ce2bbf2a2a6a68d740e54ea73c3d
SHA512

3d0794336328d57da559a77c142ccad85fd8a8ef04058d2e6647cb919da8ccb2240b4b232cf95bba7388bc3b6ca4c0a78a26ca3d0eb9939fd1a80e7f339483e5
SSDEEP

6144:Kxd0r+zwr2rNy8daL6ku/GWSHaXCMMN+3rhmBF9Z9wBjux41SkpRIEmGWLVA:+dHsr2rNv6aGTSIF9YUx4IKRNBuA

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1224-0-0x0000000000400000-0x0000000000488000-memory.dmp	upx
behavioral2/memory/1224-1-0x0000000000400000-0x0000000000488000-memory.dmp	upx
behavioral2/memory/1224-2-0x0000000000400000-0x0000000000488000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\m:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\n:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\r:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\v:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\p:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\g:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\h:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\j:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\k:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\o:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\s:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\t:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\u:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\x:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\z:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\i:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\l:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\q:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\w:	3d2b8894990faaae5eee131f689a7ad3.exe
File opened (read-only)	\??\y:	3d2b8894990faaae5eee131f689a7ad3.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	3d2b8894990faaae5eee131f689a7ad3.exe

C:\Users\Admin\AppData\Local\Temp\3d2b8894990faaae5eee131f689a7ad3.exe
"C:\Users\Admin\AppData\Local\Temp\3d2b8894990faaae5eee131f689a7ad3.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-0-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1224-1-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download
memory/1224-2-0x0000000000400000-0x0000000000488000-memory.dmp

Filesize
544KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads