cf7b7ab4b0e8c086a1ab1453a59c4f2fcffb4c172bc260b76cccb6620a1bfc85

Analysis

max time kernel
190s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

豪迪QQ群发器 2014-06-18绿色版/豪迪QQ群发器 2014/CRACK.exe
Size

1.5MB
MD5

8f242164405cd8dd7be8921f6b627701
SHA1

caf08f15ededa33c14228d313f824cb7a50a6865
SHA256

794e0210db9e81e4bbda949773a278e6a5dcfc3ff88e4c3d45493a90d1a555f8
SHA512

ca0ef40bb62264d60610cf2ae10bb28e643a3e9fc3a2e22628b4f1138c4fa141d215791790b0f8463c14309d5ce28a5a81938d5b64b261fea6830e85b08eed7d
SSDEEP

24576:B9I81bci/CI2iz3vlMxNkJ5kfsvKHingfL1HSp1IiHGwrrJKqZEu4bp0xit3C+Xh:TIubci/8C5k4KHqgj14nVJKqZCFCUN

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CRACK.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	CRACK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	CRACK.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

CRACK.exe

description ioc process

File opened for modification \??\PhysicalDrive0 CRACK.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	CRACK.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

CRACK.exe

description	ioc	process
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CRACK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	CRACK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CRACK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	CRACK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet	CRACK.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CRACK.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CRACK.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

CRACK.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier CRACK.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	CRACK.exe

Modifies registry class 2 IoCs

Processes:

CRACK.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	CRACK.exe
Key created	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	CRACK.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

CRACK.exe

pid process

1008 CRACK.exe
1008 CRACK.exe

pid	process
1008	CRACK.exe
1008	CRACK.exe

C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发器 2014-06-18绿色版\豪迪QQ群发器 2014\CRACK.exe
"C:\Users\Admin\AppData\Local\Temp\豪迪QQ群发器 2014-06-18绿色版\豪迪QQ群发器 2014\CRACK.exe"
1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1008-132-0x0000000000400000-0x0000000000743000-memory.dmp

Filesize
3.3MB

Download
memory/1008-133-0x00000000029B0000-0x00000000029BF000-memory.dmp

Filesize
60KB

Download
memory/1008-134-0x00000000029C0000-0x00000000029DB000-memory.dmp

Filesize
108KB

Download
memory/1008-135-0x0000000000400000-0x0000000000743000-memory.dmp

Filesize
3.3MB

Download