Overview

overview

7

Static

static

472b64fbaf...32.exe

windows7_x64

6

472b64fbaf...32.exe

windows10-2004_x64

7

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    24-05-2022 22:37

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    472b64fbaf32f375773fed55464eb2259031399b45c69b8381ab5168a3a65932.exe

  • Size

    5.2MB

  • MD5

    b0a659a40eba8840aa922eb5a757184c

  • SHA1

    ae798c27df3021b4b0d2252d956ac2a451c338c0

  • SHA256

    472b64fbaf32f375773fed55464eb2259031399b45c69b8381ab5168a3a65932

  • SHA512

    e437f6bc4bb40003207a39973205a92a447aa8e6027543559f80ece48d2b981630fff6e1fa6bbde6e0f58964ff5639712888e2e63ba771f74a9827411e197f1e

Score
7/10
bootkitdiscoveryevasionpersistencetrojan

Malware Config

Signatures

  • Checks BIOS information in registry 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 20 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\472b64fbaf32f375773fed55464eb2259031399b45c69b8381ab5168a3a65932.exe
    "C:\Users\Admin\AppData\Local\Temp\472b64fbaf32f375773fed55464eb2259031399b45c69b8381ab5168a3a65932.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Maps connected drives based on registry
    • Writes to the Master Boot Record (MBR)
    • Drops file in Windows directory
    • Checks SCSI registry key(s)
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4972
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
    1⤵
    • Checks SCSI registry key(s)
    • Modifies data under HKEY_USERS
    PID:3932
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x504 0x33c
    1⤵
      PID:1856

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads