e90ce6467f866612e12aef9bd5bf47934b023d1d1c9a6821a36ae31549ee6b82

Analysis

max time kernel
148s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04-02-2024 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eb17f7de69b72ae2d309160ba8fa3a3.exe
Size

338KB
MD5

8eb17f7de69b72ae2d309160ba8fa3a3
SHA1

bba3039aedbf01843c9986c1ce8adca10eeedda4
SHA256

e90ce6467f866612e12aef9bd5bf47934b023d1d1c9a6821a36ae31549ee6b82
SHA512

46f67fae3818082ec5d65e52b2555d3f8a74f0c463d3c9859024b810ae0e66a88f4ba5ac064254aa55473fe15dfca7a3bfb3b973421006e7263be3b848309e4e
SSDEEP

6144:jtMTwZdpOLDH2oB0vkUtjbPGT7GyqLc3/w6ln3YjkbA5g431qV1eo6lrb4nBuVXK:jtX3ULDHvBlUZeT7GyVoy3Y4bAG43sX5

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2660-0-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
behavioral2/memory/2660-2-0x0000000000400000-0x00000000004F9000-memory.dmp	upx
behavioral2/memory/2660-3-0x0000000000400000-0x00000000004F9000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MicrosoftWinUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8eb17f7de69b72ae2d309160ba8fa3a3.exe"	reg.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	8eb17f7de69b72ae2d309160ba8fa3a3.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
5056	reg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 5056	2660	8eb17f7de69b72ae2d309160ba8fa3a3.exe	84
PID 2660 wrote to memory of 5056	2660	8eb17f7de69b72ae2d309160ba8fa3a3.exe	84
PID 2660 wrote to memory of 5056	2660	8eb17f7de69b72ae2d309160ba8fa3a3.exe	84

C:\Users\Admin\AppData\Local\Temp\8eb17f7de69b72ae2d309160ba8fa3a3.exe
"C:\Users\Admin\AppData\Local\Temp\8eb17f7de69b72ae2d309160ba8fa3a3.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v MicrosoftWinUpdate /d C:\Users\Admin\AppData\Local\Temp\8eb17f7de69b72ae2d309160ba8fa3a3.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2660-0-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2660-1-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download
memory/2660-2-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2660-3-0x0000000000400000-0x00000000004F9000-memory.dmp

Filesize
996KB

Download
memory/2660-4-0x0000000000B40000-0x0000000000B41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads