9f03c6fc5d84290f32fa117eb2ccd9fda8cee419409cfb351aa4a4e4bac54443

Analysis

max time kernel
77s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 13:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9f03c6fc5d84290f32fa117eb2ccd9fda8cee419409cfb351aa4a4e4bac54443.exe
Size

650KB
MD5

7735f167c05d5cd61d19f96c8d16bde8
SHA1

5021e16f87dfb66ca70a1f022abc5a03e1db1ec4
SHA256

9f03c6fc5d84290f32fa117eb2ccd9fda8cee419409cfb351aa4a4e4bac54443
SHA512

9b98d85bdc3a5c67cdba0ecda99a043bbd24fce9317526aed693b2f3bbb51b8ce23b7677e8d814b1556775ece53fd9035a55b040ca4b2376e652a7b15d3c6831
SSDEEP

12288:ADBDrRvl1ExbmotxmBEQwHEv8R0xOI4HyrspX/quB:AlHZLEx1txmeC74+u/quB

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9f03c6fc5d84290f32fa117eb2ccd9fda8cee419409cfb351aa4a4e4bac54443.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9f03c6fc5d84290f32fa117eb2ccd9fda8cee419409cfb351aa4a4e4bac54443.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9f03c6fc5d84290f32fa117eb2ccd9fda8cee419409cfb351aa4a4e4bac54443.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

9f03c6fc5d84290f32fa117eb2ccd9fda8cee419409cfb351aa4a4e4bac54443.exe

description ioc process

File opened for modification \??\PhysicalDrive0 9f03c6fc5d84290f32fa117eb2ccd9fda8cee419409cfb351aa4a4e4bac54443.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	9f03c6fc5d84290f32fa117eb2ccd9fda8cee419409cfb351aa4a4e4bac54443.exe

C:\Users\Admin\AppData\Local\Temp\9f03c6fc5d84290f32fa117eb2ccd9fda8cee419409cfb351aa4a4e4bac54443.exe
"C:\Users\Admin\AppData\Local\Temp\9f03c6fc5d84290f32fa117eb2ccd9fda8cee419409cfb351aa4a4e4bac54443.exe"
1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1668-54-0x0000000075831000-0x0000000075833000-memory.dmp

Filesize
8KB

Download