b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97

Analysis

max time kernel
91s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2022, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97.exe
Size

745KB
MD5

cd09d4c0659b7df43528e94ecc0a8c06
SHA1

1a1a13090a4b565129c5153fe556450115618de7
SHA256

b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97
SHA512

77d9fbbfe7f71f1fa8e9ea59db6474578623b99e0257ac17626e071a8ad5600f28f889252413d622b4f6b3ed257099e494987963df417d53031c4e2ddb701b01
SSDEEP

12288:9qaP007/tIn1++Ubd9Ndt+G8maQelSyI8olu+Yl3b7:E4bJS+NB7/8RHIRu+YJ7

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4360	b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97.exe

C:\Users\Admin\AppData\Local\Temp\b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97.exe
"C:\Users\Admin\AppData\Local\Temp\b175f81c01b094d0995a5fb7ccadc4ff7af0d0257047d34c6bcead0135ba4c97.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4360

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4360-132-0x0000000000400000-0x000000000081E000-memory.dmp

Filesize
4.1MB

Download
memory/4360-133-0x0000000000030000-0x0000000000033000-memory.dmp

Filesize
12KB

Download
memory/4360-134-0x0000000000400000-0x000000000081E000-memory.dmp

Filesize
4.1MB

Download
memory/4360-138-0x0000000000400000-0x000000000081E000-memory.dmp

Filesize
4.1MB

Download
memory/4360-139-0x0000000000400000-0x000000000081E000-memory.dmp

Filesize
4.1MB

Download