0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c

Analysis

max time kernel
45s
max time network
50s
platform
windows7_x64
resource
win7-20220414-en
submitted
24-05-2022 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe
Size

4.3MB
MD5

49302b6e7322c4d43332764da154c265
SHA1

0a31920c37332ba69cf850e81c9e3f1600aede88
SHA256

0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c
SHA512

1b14c817fed377bb8063737d75f6f8c131a150ab334ceb8359a7222b1a9ed0ff0d344a55dac54393c52492013073f0d03adff8f0bbd220e840cc1d4106385886

Score

9^/10

bootkit evasion persistence trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe

description ioc process

File opened for modification \??\PhysicalDrive0 0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe

pid process

884 0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe

pid	process
884	0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe

C:\Users\Admin\AppData\Local\Temp\0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe
"C:\Users\Admin\AppData\Local\Temp\0d9d5c831a3b7fa7488bdac603ae2831c2687e73f6a4c47eb976475b2db3432c.exe"
1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:884

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/884-54-0x0000000074C81000-0x0000000074C83000-memory.dmp

Filesize
8KB

Download
memory/884-55-0x0000000076F80000-0x0000000077100000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads