Analysis
-
max time kernel
154s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 20:55
Static task
static1
Behavioral task
behavioral1
Sample
efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe
Resource
win10v2004-20221111-en
General
-
Target
efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe
-
Size
1.6MB
-
MD5
edba583f1dc93fb81750278507d21a56
-
SHA1
9777f04f51c292ae6943d093aae76dd5fab3c7ca
-
SHA256
efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9
-
SHA512
00087da125d6f041802287d2475cd30f41eedb09ebba001c55f0e08e89c2b5f865c7c38368f9f22cdd33e4d79b3d5bbac044126275122c2c872c2fdae724494a
-
SSDEEP
49152:b3kpPSVcsWAZpBjgO7HGZPL79fyaQtirOF:b3kpWcbAZpB7atH9fQt
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exedescription ioc process File opened for modification \??\PhysicalDrive0 efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exepid process 2964 efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe 2964 efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe"C:\Users\Admin\AppData\Local\Temp\efd98f1899a655601dface66665de85596a406396fa492725c4ad79764848ae9.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx