6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7.exe
Size

512KB
MD5

164b5f30f5f77b6e74b2197869bd4cc6
SHA1

93126f1f312c3a48fb5fdad0f2ad757c77f7b94c
SHA256

6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7
SHA512

86da2c61879533032ed09bbc4533f01af215e30da7aae250cd510e95c80d9d60a817b249b630822ff385e85a337f6a70176f157b70a27226b9c9c5e9e8ce5c35
SSDEEP

12288:GR41sKv76QD7ETeGAJE9OTn9bkLOy6zh9B3t1:GR4jeHTeGy2OT94izh

Score

9^/10

bootkit persistence

Malware Config

Signatures

Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2740-4-0x0000000000400000-0x0000000002CDF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2740-5-0x0000000000400000-0x0000000002CDF000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
behavioral1/memory/2740-8-0x0000000000400000-0x000000000046F000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7.exe

description ioc process

File opened for modification \??\PHYSICALDRIVE0 6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7.exe

description	ioc	process
File opened for modification	\??\PHYSICALDRIVE0	6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7.exe

C:\Users\Admin\AppData\Local\Temp\6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7.exe
"C:\Users\Admin\AppData\Local\Temp\6f02f16bf43c6c3872ffb987a37cccb789a2d95480b68b9a20a1a7aefff752b7.exe"
1⤵
- Writes to the Master Boot Record (MBR)
PID:2740

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2740-2-0x0000000004490000-0x00000000044FB000-memory.dmp

Filesize
428KB

Download
memory/2740-3-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2740-1-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/2740-4-0x0000000000400000-0x0000000002CDF000-memory.dmp

Filesize
40.9MB

Download
memory/2740-5-0x0000000000400000-0x0000000002CDF000-memory.dmp

Filesize
40.9MB

Download
memory/2740-7-0x00000000002F0000-0x00000000003F0000-memory.dmp

Filesize
1024KB

Download
memory/2740-8-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download