253ee9373dcb2323e52cd584044facfaa9004eec770edac83d48fde4eee89d31

General

Target

74fdc9bbf37f889275a17e275e083e59.exe
Size

400KB
MD5

74fdc9bbf37f889275a17e275e083e59
SHA1

99db239de57a96fa6fafc7ed92fb28edf5ea68a4
SHA256

253ee9373dcb2323e52cd584044facfaa9004eec770edac83d48fde4eee89d31
SHA512

4064b2a85e83ebacdaa3d4a1e3d47a02a69b03ac5df18109e1dcf35846071b93d997ed53d4cb7026f472f6442f5845ba35a4d3cfc1a763af6b035696efd12c73
SSDEEP

12288:7XZPQxH6N7fn5nP7BzYKj86sfZQj6GkHHq4:7p8H6Rn5P7FYOCtFHK4

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

74fdc9bbf37f889275a17e275e083e59.exe

description ioc process

File opened for modification \??\PhysicalDrive0 74fdc9bbf37f889275a17e275e083e59.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

74fdc9bbf37f889275a17e275e083e59.exe

description pid process target process

PID 2748 set thread context of 2852 2748 74fdc9bbf37f889275a17e275e083e59.exe 74fdc9bbf37f889275a17e275e083e59.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	74fdc9bbf37f889275a17e275e083e59.exe

description	pid	process	target process
PID 2748 set thread context of 2852	2748	74fdc9bbf37f889275a17e275e083e59.exe	74fdc9bbf37f889275a17e275e083e59.exe

Modifies registry class 3 IoCs

Processes:

74fdc9bbf37f889275a17e275e083e59.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.key	74fdc9bbf37f889275a17e275e083e59.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\	74fdc9bbf37f889275a17e275e083e59.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile"	74fdc9bbf37f889275a17e275e083e59.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

74fdc9bbf37f889275a17e275e083e59.exe

pid process

2852 74fdc9bbf37f889275a17e275e083e59.exe
2852 74fdc9bbf37f889275a17e275e083e59.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

74fdc9bbf37f889275a17e275e083e59.exe

pid process

2748 74fdc9bbf37f889275a17e275e083e59.exe

pid	process
2852	74fdc9bbf37f889275a17e275e083e59.exe
2852	74fdc9bbf37f889275a17e275e083e59.exe

pid	process
2748	74fdc9bbf37f889275a17e275e083e59.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

74fdc9bbf37f889275a17e275e083e59.exe74fdc9bbf37f889275a17e275e083e59.exe

description	pid	process	target process
PID 2748 wrote to memory of 2852	2748	74fdc9bbf37f889275a17e275e083e59.exe	74fdc9bbf37f889275a17e275e083e59.exe
PID 2748 wrote to memory of 2852	2748	74fdc9bbf37f889275a17e275e083e59.exe	74fdc9bbf37f889275a17e275e083e59.exe
PID 2748 wrote to memory of 2852	2748	74fdc9bbf37f889275a17e275e083e59.exe	74fdc9bbf37f889275a17e275e083e59.exe
PID 2748 wrote to memory of 2852	2748	74fdc9bbf37f889275a17e275e083e59.exe	74fdc9bbf37f889275a17e275e083e59.exe
PID 2748 wrote to memory of 2852	2748	74fdc9bbf37f889275a17e275e083e59.exe	74fdc9bbf37f889275a17e275e083e59.exe
PID 2748 wrote to memory of 2852	2748	74fdc9bbf37f889275a17e275e083e59.exe	74fdc9bbf37f889275a17e275e083e59.exe
PID 2748 wrote to memory of 2852	2748	74fdc9bbf37f889275a17e275e083e59.exe	74fdc9bbf37f889275a17e275e083e59.exe
PID 2748 wrote to memory of 2852	2748	74fdc9bbf37f889275a17e275e083e59.exe	74fdc9bbf37f889275a17e275e083e59.exe
PID 2852 wrote to memory of 1224	2852	74fdc9bbf37f889275a17e275e083e59.exe	Explorer.EXE
PID 2852 wrote to memory of 1224	2852	74fdc9bbf37f889275a17e275e083e59.exe	Explorer.EXE
PID 2852 wrote to memory of 1224	2852	74fdc9bbf37f889275a17e275e083e59.exe	Explorer.EXE
PID 2852 wrote to memory of 1224	2852	74fdc9bbf37f889275a17e275e083e59.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1224

C:\Users\Admin\AppData\Local\Temp\74fdc9bbf37f889275a17e275e083e59.exe
"C:\Users\Admin\AppData\Local\Temp\74fdc9bbf37f889275a17e275e083e59.exe"
2⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748

C:\Users\Admin\AppData\Local\Temp\74fdc9bbf37f889275a17e275e083e59.exe
C:\Users\Admin\AppData\Local\Temp\74fdc9bbf37f889275a17e275e083e59.exe
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2852

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1

T1542

Bootkit

1

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1224-31-0x000000007FFF0000-0x000000007FFF7000-memory.dmp

Filesize
28KB

Download
memory/2748-11-0x0000000000650000-0x0000000000651000-memory.dmp

Filesize
4KB

Download
memory/2748-3-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2748-16-0x0000000002870000-0x0000000002923000-memory.dmp

Filesize
716KB

Download
memory/2748-1-0x0000000000320000-0x0000000000322000-memory.dmp

Filesize
8KB

Download
memory/2748-6-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2748-7-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2748-8-0x0000000000240000-0x0000000000250000-memory.dmp

Filesize
64KB

Download
memory/2748-9-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2748-13-0x0000000000670000-0x0000000000671000-memory.dmp

Filesize
4KB

Download
memory/2748-14-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/2748-12-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2748-0-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2748-27-0x0000000000400000-0x00000000004B3000-memory.dmp

Filesize
716KB

Download
memory/2748-2-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2748-5-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/2852-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2852-22-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2852-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2852-45-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2852-25-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2852-28-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2852-29-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2852-15-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2852-30-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2852-44-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/2852-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing