Overview

overview

9

Static

static

9

43f7709a6c...17.exe

windows7-x64

9

43f7709a6c...17.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    118s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    30-06-2024 16:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    43f7709a6c3408eca55af1a45a829b8ed72d37480fe21afa6470c5c45f079017.exe

  • Size

    8.7MB

  • MD5

    3d8489d1729d418be214531adc43606b

  • SHA1

    00888feb0dc73a1d9a92c3fe3df8e03e40a59044

  • SHA256

    43f7709a6c3408eca55af1a45a829b8ed72d37480fe21afa6470c5c45f079017

  • SHA512

    a3c7d91f6e02c9e78c43d689e9db1023d341c377754c7b2488fdc06e04c0823cdb57e4d2201ac0ab4b3e5723e7014520ce0df9a45d0607266f9f8865a6c05549

  • SSDEEP

    196608:IrfTXa7c9bWU+LEIP+6jU94HRT8B44qCdw37NQCphC9:aXa7c9bWU+LEt94H58jqCy37NzpA

Score
9/10
bootkitoss_akpersistenceupx

Malware Config

Signatures

  • detect oss ak 6 IoCs

    oss ak information detected.

    oss_ak
  • UPX packed file 23 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43f7709a6c3408eca55af1a45a829b8ed72d37480fe21afa6470c5c45f079017.exe
    "C:\Users\Admin\AppData\Local\Temp\43f7709a6c3408eca55af1a45a829b8ed72d37480fe21afa6470c5c45f079017.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of SetWindowsHookEx
    PID:2140

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2140-0-0x00000000006F3000-0x00000000006F4000-memory.dmp
    Filesize

    4KB

    Download
  • memory/2140-3-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-2-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-1-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-44-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-42-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-46-0x0000000000400000-0x0000000000D1B000-memory.dmp
    Filesize

    9.1MB

    Download
  • memory/2140-40-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-38-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-36-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-34-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-47-0x0000000000400000-0x0000000000D1B000-memory.dmp
    Filesize

    9.1MB

    Download
  • memory/2140-32-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-30-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-28-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-48-0x0000000000400000-0x0000000000D1B000-memory.dmp
    Filesize

    9.1MB

    Download
  • memory/2140-26-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-24-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-49-0x0000000000400000-0x0000000000D1B000-memory.dmp
    Filesize

    9.1MB

    Download
  • memory/2140-22-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-20-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-50-0x0000000000400000-0x0000000000D1B000-memory.dmp
    Filesize

    9.1MB

    Download
  • memory/2140-18-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-16-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-14-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-12-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-10-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-8-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-5-0x00000000003C0000-0x00000000003FE000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2140-6-0x0000000000400000-0x0000000000D1B000-memory.dmp
    Filesize

    9.1MB

    Download