9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d

Analysis

max time kernel
140s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 03:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe
Size

14.7MB
MD5

c5b192a11b0e15de6a26847ef2bf6a42
SHA1

85ed6d8603181f41448acadb7c2a04d524a9304b
SHA256

9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d
SHA512

579f63ce0d1ef0951db79a065047c9b6535a39ec8f34ac8134e6f47a94a7705639795f9377a11a0190708530fa68c43f58e56949dd80e0d46e7dd10fd0feb54d
SSDEEP

393216:89yt4gJYhVnE54X96+lAHSRW7Vzb6uWoG7HDOTDeO4kjTS:89yt4gqvEK96+lAHSAzgTm4kP

Score

7^/10

bootkit persistence upx

Malware Config

Signatures

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2480-0-0x0000000000400000-0x00000000017DE000-memory.dmp	upx
behavioral1/memory/2480-8-0x0000000000400000-0x00000000017DE000-memory.dmp	upx
behavioral1/memory/2480-12-0x0000000000400000-0x00000000017DE000-memory.dmp	upx
behavioral1/memory/2480-13-0x0000000000400000-0x00000000017DE000-memory.dmp	upx
behavioral1/memory/2480-14-0x0000000000400000-0x00000000017DE000-memory.dmp	upx
behavioral1/memory/2480-15-0x0000000000400000-0x00000000017DE000-memory.dmp	upx
behavioral1/memory/2480-16-0x0000000000400000-0x00000000017DE000-memory.dmp	upx
behavioral1/memory/2480-17-0x0000000000400000-0x00000000017DE000-memory.dmp	upx
behavioral1/memory/2480-18-0x0000000000400000-0x00000000017DE000-memory.dmp	upx
behavioral1/memory/2480-19-0x0000000000400000-0x00000000017DE000-memory.dmp	upx
behavioral1/memory/2480-20-0x0000000000400000-0x00000000017DE000-memory.dmp	upx
behavioral1/memory/2480-21-0x0000000000400000-0x00000000017DE000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe

description ioc process

File opened for modification \??\PhysicalDrive0 9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe
Drops file in Windows directory 1 IoCs

Processes:

9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe

description ioc process

File opened for modification C:\Windows\Mreinstool.ini 9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe

pid process

2480 9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe

pid process

2480 9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe

description	ioc	process
File opened for modification	C:\Windows\Mreinstool.ini	9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe

pid	process
2480	9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe
2480	9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe
2480	9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe
2480	9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe

C:\Users\Admin\AppData\Local\Temp\9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe
"C:\Users\Admin\AppData\Local\Temp\9d0fe6b507c189c4d2d12dc5c1d025bb64e163a35541351fb19f262445bfd83d.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2480

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2480-0-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download
memory/2480-8-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download
memory/2480-12-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download
memory/2480-13-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download
memory/2480-14-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download
memory/2480-15-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download
memory/2480-16-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download
memory/2480-17-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download
memory/2480-18-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download
memory/2480-19-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download
memory/2480-20-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download
memory/2480-21-0x0000000000400000-0x00000000017DE000-memory.dmp

Filesize
19.9MB

Download