Analysis
-
max time kernel
148s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 14:53
Behavioral task
behavioral1
Sample
4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe
Resource
win10v2004-20220812-en
General
-
Target
4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe
-
Size
30.1MB
-
MD5
3717a1cc9c3aced10b9f6dce24e00ea5
-
SHA1
0b07785d4e72993e1459edd498091ac1f0250e01
-
SHA256
4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272
-
SHA512
63c765884230989c4917230ae14c61992ee6d8deb9f28adf057c2afa24e7ba2b9c1c47cb6b522b05c5674e2e151b4df78a00ba59e6e4de287f668c33598b12be
-
SSDEEP
786432:DH22j0SJs237EEmAHS5lmqLKJp/R6nPzyWp/8dDfLy4Wt:7Twf237Eiy+qgfQuGUdDfLzO
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2112-132-0x0000000000400000-0x0000000000575000-memory.dmp upx behavioral2/memory/2112-133-0x0000000000400000-0x0000000000575000-memory.dmp upx behavioral2/memory/2112-134-0x0000000000400000-0x0000000000575000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exedescription ioc process File opened for modification \??\PhysicalDrive0 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe -
Modifies registry class 15 IoCs
Processes:
4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\mid = "4073223675" 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "0" 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5} 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0} 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0} 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "ybipshrc5bkd2oaj7yevgt8lvwix" 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\svrid = "ybipshrc5bkd2oaj7yevgt8lvwix" 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\mid = "4073223675" 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idno = "1" 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories\{A5F7140E-4311-4ef9-AABC-F55941B5EBE5}\idex = "bc70b6e64b22c6fe62eafb5da1f49b90" 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\{9B7A98EC-7EF9-468c-ACC8-37C793DBD7E0}\Implemented Categories 4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe"C:\Users\Admin\AppData\Local\Temp\4891e15b645c0bda957629e5bd98782dbabf0911912bd94d238d02383c76a272.exe"1⤵
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Modifies registry class