Analysis
-
max time kernel
38s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-05-2022 21:51
Static task
static1
Behavioral task
behavioral1
Sample
616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe
Resource
win10v2004-20220414-en
General
-
Target
616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe
-
Size
956KB
-
MD5
d6e0738dd82aad7e9a69c82d90222c99
-
SHA1
f95d5104308894c9e687a1bc19f2f4306493afdd
-
SHA256
616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2
-
SHA512
734e286fe3fa419d45d5fdbc10d80eebaf9c80fdfefe5b917eb5f162ef3551b7b0ec4702fef86505845fec3af4adae2da57cd9c3ec208532a323cbdb885586da
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/972-55-0x0000000010000000-0x000000001000B000-memory.dmp upx behavioral1/memory/972-56-0x0000000010000000-0x000000001000B000-memory.dmp upx -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exedescription ioc process File opened for modification \??\PhysicalDrive0 616fdb288921e5ea95792679d2725f640c4ba3c08e40e7a9c58113903f6ecef2.exe