bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6

Analysis

max time kernel
2s
max time network
1s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 06:22

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
Size

5.8MB
MD5

93abf6b6c90f0d5a5b5211fb67dadc74
SHA1

79c7e8f806f51e149634a238a3e4e28067bb7bd0
SHA256

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6
SHA512

a06698d20011c19d10ad0db0e6486cd5ea2e5d653051275193d2f3008d21e9e52f4688edcd07501e84f77189cf941f066032f22f6a54afe85516ca2098242f23
SSDEEP

98304:Cze2df9cx1hD/JNmlovT2clFC6sJPrWvOgLwCB6c3kESDP5Ue/aSCtSQTWY:qreDh0ovT2clFCtlSPkEFhL

Score

7^/10

bootkit persistence vmprotect

Malware Config

Signatures

VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
vmprotect

Processes:

resource yara_rule

behavioral1/memory/1676-40-0x0000000000400000-0x0000000000E3C000-memory.dmp vmprotect
behavioral1/memory/1676-39-0x0000000000400000-0x0000000000E3C000-memory.dmp vmprotect
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

description ioc process

File opened for modification \??\physicaldrive0 bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

pid process

1676 bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
1676 bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

description pid process

Token: SeShutdownPrivilege 1676 bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

pid process

1676 bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
1676 bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

resource	yara_rule
behavioral1/memory/1676-40-0x0000000000400000-0x0000000000E3C000-memory.dmp	vmprotect
behavioral1/memory/1676-39-0x0000000000400000-0x0000000000E3C000-memory.dmp	vmprotect

description	ioc	process
File opened for modification	\??\physicaldrive0	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

pid	process
1676	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
1676	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

description	pid	process
Token: SeShutdownPrivilege	1676	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

pid	process
1676	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
1676	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

C:\Users\Admin\AppData\Local\Temp\bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
"C:\Users\Admin\AppData\Local\Temp\bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1676

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1676-29-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1676-27-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1676-24-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1676-22-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1676-19-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1676-17-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1676-14-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1676-12-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1676-9-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1676-7-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1676-5-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/1676-4-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1676-2-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1676-0-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1676-36-0x0000000000502000-0x000000000087A000-memory.dmp

Filesize
3.5MB

Download
memory/1676-34-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1676-40-0x0000000000400000-0x0000000000E3C000-memory.dmp

Filesize
10.2MB

Download
memory/1676-39-0x0000000000400000-0x0000000000E3C000-memory.dmp

Filesize
10.2MB

Download
memory/1676-32-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1676-30-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download