0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4

Analysis

max time kernel
28s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4.exe
Size

749KB
MD5

fb3b4278ddaf4e3ea8a74a3309d4c28d
SHA1

93cd7cb15f099c0e0f3f3396038d3dbf948ca5f2
SHA256

0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4
SHA512

a7d77c1e259b345cdaf68cff497559207c28194a69e7e57811cd9b4efe9dd45ac65ec04a5363adad0a991f098a6b15819f672d065348cd22c6e5aef2e80edd38
SSDEEP

12288:R1HCq6pjUJjz1MlY7W16W1koLtBN+tXCJZjiqevn6UJKAX:RdCjUJjzIY7Wt1koNZjiJ6UJKAX

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4.exe

description ioc process

File opened for modification \??\PhysicalDrive0 0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4.exe

C:\Users\Admin\AppData\Local\Temp\0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4.exe
"C:\Users\Admin\AppData\Local\Temp\0ed55e3d7c320506f04ed52ebc46c256fe813aa4387d5ecd259433c20ec657d4.exe"
1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
PID:1632

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1632-54-0x00000000761F1000-0x00000000761F3000-memory.dmp

Filesize
8KB

Download