Analysis

  • max time kernel
    40s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    25-05-2022 01:57

General

  • Target

    cc83674574400c64fec6fb957bb2ca601fb81cdb8af63dd6864e83011c39db0e.exe

  • Size

    956KB

  • MD5

    944d363650986fb02461062fcbfbe947

  • SHA1

    932b5f96d3ed499722736fd761d6fbd82e7d750b

  • SHA256

    cc83674574400c64fec6fb957bb2ca601fb81cdb8af63dd6864e83011c39db0e

  • SHA512

    59729e709607d4acdfc1d103fb62a23a39370bfe75c4c4ad789e5ab635d2b0e5efc7cca4168bbd7ded9295c97933c948dcc1c9584544c144c7bb3ba2316b3b42

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc83674574400c64fec6fb957bb2ca601fb81cdb8af63dd6864e83011c39db0e.exe
    "C:\Users\Admin\AppData\Local\Temp\cc83674574400c64fec6fb957bb2ca601fb81cdb8af63dd6864e83011c39db0e.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    PID:1520

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1520-54-0x0000000075841000-0x0000000075843000-memory.dmp

    Filesize

    8KB

  • memory/1520-55-0x0000000010000000-0x000000001000B000-memory.dmp

    Filesize

    44KB

  • memory/1520-56-0x0000000010000000-0x000000001000B000-memory.dmp

    Filesize

    44KB