Analysis
-
max time kernel
45s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 09:19
Static task
static1
Behavioral task
behavioral1
Sample
9a8a025b581b5d47049ce5b8888af0923739b9c895f1e12fc7879917c75e671a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9a8a025b581b5d47049ce5b8888af0923739b9c895f1e12fc7879917c75e671a.exe
Resource
win10v2004-20221111-en
General
-
Target
9a8a025b581b5d47049ce5b8888af0923739b9c895f1e12fc7879917c75e671a.exe
-
Size
1.3MB
-
MD5
01303269b47c3411fe6094c6659f8b8c
-
SHA1
77d2ab4d55cea7926dd4f2d50199dcb77c9b57d5
-
SHA256
9a8a025b581b5d47049ce5b8888af0923739b9c895f1e12fc7879917c75e671a
-
SHA512
135b5971b62898d946846cb8faf9e06b22f98b5b58831c97f54130908b0edfed85763a6e1f148bc9121d2da7b00657a5877c9e1538ce6c9c7ab0d95a63a6bb4c
-
SSDEEP
24576:FdWHYycqy2QIzGyiy9lSOuK+lyXLpaCKQshJBt663nEZOc72fD7MP+h2wI:KHFcqyb4lSBOfOc6UqI
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
9a8a025b581b5d47049ce5b8888af0923739b9c895f1e12fc7879917c75e671a.exedescription ioc process File opened for modification \??\PhysicalDrive0 9a8a025b581b5d47049ce5b8888af0923739b9c895f1e12fc7879917c75e671a.exe -
Modifies registry class 3 IoCs
Processes:
9a8a025b581b5d47049ce5b8888af0923739b9c895f1e12fc7879917c75e671a.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 9a8a025b581b5d47049ce5b8888af0923739b9c895f1e12fc7879917c75e671a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 9a8a025b581b5d47049ce5b8888af0923739b9c895f1e12fc7879917c75e671a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 9a8a025b581b5d47049ce5b8888af0923739b9c895f1e12fc7879917c75e671a.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1760-54-0x0000000000400000-0x0000000000658000-memory.dmpFilesize
2.3MB
-
memory/1760-55-0x0000000075281000-0x0000000075283000-memory.dmpFilesize
8KB
-
memory/1760-56-0x0000000000320000-0x0000000000350000-memory.dmpFilesize
192KB
-
memory/1760-57-0x0000000000400000-0x0000000000658000-memory.dmpFilesize
2.3MB