bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6

Analysis

max time kernel
1s
max time network
3s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-06-2024 06:22

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
Size

5.8MB
MD5

93abf6b6c90f0d5a5b5211fb67dadc74
SHA1

79c7e8f806f51e149634a238a3e4e28067bb7bd0
SHA256

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6
SHA512

a06698d20011c19d10ad0db0e6486cd5ea2e5d653051275193d2f3008d21e9e52f4688edcd07501e84f77189cf941f066032f22f6a54afe85516ca2098242f23
SSDEEP

98304:Cze2df9cx1hD/JNmlovT2clFC6sJPrWvOgLwCB6c3kESDP5Ue/aSCtSQTWY:qreDh0ovT2clFCtlSPkEFhL

Score

7^/10

bootkit persistence vmprotect

Malware Config

Signatures

VMProtect packed file 3 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/1456-8-0x0000000000400000-0x0000000000E3C000-memory.dmp	vmprotect
behavioral2/memory/1456-11-0x0000000000400000-0x0000000000E3C000-memory.dmp	vmprotect
behavioral2/memory/1456-12-0x0000000000400000-0x0000000000E3C000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

description ioc process

File opened for modification \??\physicaldrive0 bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

description	ioc	process
File opened for modification	\??\physicaldrive0	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

pid	process
1456	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
1456	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
1456	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
1456	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

description pid process

Token: SeShutdownPrivilege 1456 bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

pid process

1456 bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
1456 bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

description	pid	process
Token: SeShutdownPrivilege	1456	bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe

C:\Users\Admin\AppData\Local\Temp\bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe
"C:\Users\Admin\AppData\Local\Temp\bcf9d9afcd4a13f49a3df860666e076cd87f88a47b2c97bd8d60c3719335ced6.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1456

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1456-1-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/1456-0-0x0000000000FE0000-0x0000000000FE1000-memory.dmp

Filesize
4KB

Download
memory/1456-7-0x0000000002D30000-0x0000000002D31000-memory.dmp

Filesize
4KB

Download
memory/1456-8-0x0000000000400000-0x0000000000E3C000-memory.dmp

Filesize
10.2MB

Download
memory/1456-6-0x0000000000502000-0x000000000087A000-memory.dmp

Filesize
3.5MB

Download
memory/1456-5-0x0000000002D20000-0x0000000002D21000-memory.dmp

Filesize
4KB

Download
memory/1456-11-0x0000000000400000-0x0000000000E3C000-memory.dmp

Filesize
10.2MB

Download
memory/1456-4-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/1456-3-0x00000000015E0000-0x00000000015E1000-memory.dmp

Filesize
4KB

Download
memory/1456-2-0x0000000001140000-0x0000000001141000-memory.dmp

Filesize
4KB

Download
memory/1456-12-0x0000000000400000-0x0000000000E3C000-memory.dmp

Filesize
10.2MB

Download