0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a

Analysis

max time kernel
186s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a.exe
Size

2.6MB
MD5

08fbdd5a8313912849157caa9aadb5a3
SHA1

efde38e5ccc7c1e9d0005246ca06b8e8048da97e
SHA256

0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a
SHA512

681c00f6640c6905385fded798dd24655587a98c761e99dd173c0dee89e2593fdc73c8675a55c5abdea1379cf349bf418de84089c32a2e316074cd173f5caf5a
SSDEEP

24576:uYsz2J48lMjIh5XRyc7eGoYzPN/nm8VysAls5xPEvZqIq9I/7+b07K+GkJOeBQWF:umiGlAZvZqIQ0KSKEtG7YvdOa/

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBIOSDate	0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a.exe

description ioc process

File opened for modification \??\PhysicalDrive0 0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBIOSDate	0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a.exe

C:\Users\Admin\AppData\Local\Temp\0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a.exe
"C:\Users\Admin\AppData\Local\Temp\0442d1207f7e64beed3b3ebe8e924f470021c66137f37c5a63a9631f7913043a.exe"
1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
PID:4660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads