c7632a1bbe82c3d2ae9146a0289bc2080d03878dd89fd1d9e9503a9e57af43c4

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
01-07-2024 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1792EL4.4?/ElementsEditor.exe
Size

1.0MB
MD5

0ddb19bd95ae8a7aca1ad5a94e7ffcad
SHA1

1f45083609a8c4aab77a45ba27062649f5991e33
SHA256

f7ee4e1d2cdcae4ea22583854d9fa2cad072741f487cd3f7b547c598caaf66f1
SHA512

aa27d80b9f1bd2d77877ec6d5caf9092cf5d1874347246308948b6095e2522edf744656005554d79485dc87da17246f8f0c4d9df8ca3ced5bd69ce99ac62cb8c
SSDEEP

24576:vbYw5NquEjJoFT39qBKQgn6QrraispwqZJGFiWdM:h5kuE2x39q8N/rraRbY

Score

7^/10

bootkit persistence vmprotect

Malware Config

Signatures

VMProtect packed file 5 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/2756-0-0x0000000000400000-0x0000000000614000-memory.dmp	vmprotect
behavioral1/memory/2756-10-0x0000000000400000-0x0000000000614000-memory.dmp	vmprotect
behavioral1/memory/2756-12-0x0000000000400000-0x0000000000614000-memory.dmp	vmprotect
behavioral1/memory/2756-1394-0x0000000070270000-0x0000000070829000-memory.dmp	vmprotect
behavioral1/memory/2756-1398-0x0000000070270000-0x0000000070829000-memory.dmp	vmprotect

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

ElementsEditor.exe

description ioc process

File opened for modification \??\PhysicalDrive0 ElementsEditor.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

ElementsEditor.exe

pid process

2756 ElementsEditor.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ElementsEditor.exe

description pid process

Token: SeDebugPrivilege 2756 ElementsEditor.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	ElementsEditor.exe

pid	process
2756	ElementsEditor.exe

description	pid	process
Token: SeDebugPrivilege	2756	ElementsEditor.exe

C:\Users\Admin\AppData\Local\Temp\1792EL4.4_\ElementsEditor.exe
"C:\Users\Admin\AppData\Local\Temp\1792EL4.4_\ElementsEditor.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2756-0-0x0000000000400000-0x0000000000614000-memory.dmp

Filesize
2.1MB

Download
memory/2756-3-0x0000000000401000-0x000000000041B000-memory.dmp

Filesize
104KB

Download
memory/2756-1-0x0000000077F90000-0x0000000077F91000-memory.dmp

Filesize
4KB

Download
memory/2756-8-0x0000000076C10000-0x0000000076C11000-memory.dmp

Filesize
4KB

Download
memory/2756-10-0x0000000000400000-0x0000000000614000-memory.dmp

Filesize
2.1MB

Download
memory/2756-4-0x0000000077F90000-0x0000000077F91000-memory.dmp

Filesize
4KB

Download
memory/2756-12-0x0000000000400000-0x0000000000614000-memory.dmp

Filesize
2.1MB

Download
memory/2756-13-0x0000000004950000-0x00000000049C8000-memory.dmp

Filesize
480KB

Download
memory/2756-14-0x0000000004A10000-0x0000000004A88000-memory.dmp

Filesize
480KB

Download
memory/2756-27-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-64-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-18-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-20-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-46-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-68-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-66-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-62-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-60-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-58-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-56-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-52-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-48-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-44-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-42-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-40-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-36-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-32-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-30-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-28-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-22-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-54-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-16-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-50-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-38-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-15-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-34-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-24-0x0000000004A10000-0x0000000004A81000-memory.dmp

Filesize
452KB

Download
memory/2756-1394-0x0000000070270000-0x0000000070829000-memory.dmp

Filesize
5.7MB

Download
memory/2756-1393-0x00000000051D0000-0x00000000051EF000-memory.dmp

Filesize
124KB

Download
memory/2756-1398-0x0000000070270000-0x0000000070829000-memory.dmp

Filesize
5.7MB

Download