ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633

Analysis

max time kernel
141s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26-05-2024 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe
Size

11.0MB
MD5

7eae7beacdbedc4a20e753e9b661a472
SHA1

f27b9ba498a43959733a654e73502485970e2aea
SHA256

ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633
SHA512

9a73742980786cca50096d811686cd9ce5f799a4bc7b10c5953e1d13d52ed0df57cbfc56d0dce5a4de0d578cac59201b9981b47283f63127ca78196d76544e3c
SSDEEP

196608:WdBlXFJJViZABzvzeMNcDW4TumyuxF2qG2/2ThLMQgG:WBlLyZazeMcDW0z2qG2/2FQQ

Score

9^/10

bootkit oss_ak persistence upx

Malware Config

Signatures

detect oss ak 18 IoCs

oss ak information detected.

oss_ak

Processes:

resource	yara_rule
behavioral2/memory/2384-7-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-52-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-53-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-54-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-55-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-56-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-57-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-58-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-59-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-60-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-61-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-62-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-63-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-64-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-65-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-66-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-67-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff
behavioral2/memory/2384-69-0x0000000000400000-0x0000000000F69000-memory.dmp	detect_ak_stuff

UPX packed file 23 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2384-9-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-45-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-51-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-49-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-47-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-43-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-41-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-39-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-35-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-34-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-29-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-27-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-25-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-23-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-21-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-19-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-18-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-15-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-13-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-31-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-11-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/2384-10-0x0000000010000000-0x000000001003E000-memory.dmp	upx

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe

description ioc process

File opened for modification \??\PhysicalDrive0 ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe

pid process

2384 ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe

pid	process
2384	ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe
2384	ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe
2384	ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe
2384	ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe
2384	ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe
2384	ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe

pid	process
2384	ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe
2384	ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe
2384	ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe
2384	ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe

C:\Users\Admin\AppData\Local\Temp\ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe
"C:\Users\Admin\AppData\Local\Temp\ff1dbe82c659e3da8a962f2e9c97d541ee72f1277b62a30de50042cc956a7633.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2384-1-0x0000000001240000-0x0000000001241000-memory.dmp

Filesize
4KB

Download
memory/2384-6-0x00000000012B0000-0x00000000012B1000-memory.dmp

Filesize
4KB

Download
memory/2384-8-0x0000000000944000-0x0000000000D77000-memory.dmp

Filesize
4.2MB

Download
memory/2384-5-0x00000000012A0000-0x00000000012A1000-memory.dmp

Filesize
4KB

Download
memory/2384-4-0x0000000001290000-0x0000000001291000-memory.dmp

Filesize
4KB

Download
memory/2384-3-0x0000000001280000-0x0000000001281000-memory.dmp

Filesize
4KB

Download
memory/2384-2-0x0000000001270000-0x0000000001271000-memory.dmp

Filesize
4KB

Download
memory/2384-0-0x0000000001110000-0x0000000001111000-memory.dmp

Filesize
4KB

Download
memory/2384-7-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-9-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-45-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-51-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-49-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-52-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-47-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-43-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-41-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-39-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-35-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-34-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-29-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-27-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-25-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-23-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-21-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-19-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-18-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-15-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-13-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-31-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-11-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-10-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/2384-53-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-54-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-55-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-56-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-57-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-58-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-59-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-60-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-61-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-62-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-63-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-64-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-65-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-66-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-67-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download
memory/2384-68-0x0000000000944000-0x0000000000D77000-memory.dmp

Filesize
4.2MB

Download
memory/2384-69-0x0000000000400000-0x0000000000F69000-memory.dmp

Filesize
11.4MB

Download