Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-05-2022 20:09
Static task
static1
Behavioral task
behavioral1
Sample
0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe
Resource
win10v2004-20220414-en
General
-
Target
0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe
-
Size
241KB
-
MD5
4acac9b0996f24e933283f143de64875
-
SHA1
44043a89159372246ea8b7be18d42236e0eafb2c
-
SHA256
0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de
-
SHA512
29cd35ff71caae73866e293ed8ba2f7ac4127929587f74608d52897cafd88bec572453fa3ded336e6c17ff3cf21d6bf5edf6eb1ce21c917c8a9e776380197d91
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exedescription ioc process File opened (read-only) \??\f: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\k: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\u: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\x: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\l: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\n: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\o: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\p: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\t: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\v: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\z: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\g: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\h: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\j: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\q: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\s: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\w: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\e: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\i: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\m: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\r: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe File opened (read-only) \??\y: 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exedescription ioc process File opened for modification \??\PhysicalDrive0 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe -
Drops file in Program Files directory 1 IoCs
Processes:
0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exedescription ioc process File opened for modification C:\Program Files (x86)\SAItest.txt 0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe"C:\Users\Admin\AppData\Local\Temp\0060e65cb2d97ad21bf8b2417fad0486d3950c3d10e6107f15166564758eb3de.exe"1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory