5fedb45dfc3128ab5d473a52506b5ad146442c266ae80e2050321d3c9e07b9ee

Analysis

max time kernel
30s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CardMaster/CardMp3.exe
Size

429KB
MD5

57f5a6a975e9d06f6ba683c08ceda99b
SHA1

e3794bb61bd24a5394dd4405f23198d30360e258
SHA256

5e27877fa76108ed93a47fea754e96c2595e78682a813caff669b9e7962e9a83
SHA512

4c7f7e1a8de73dd06e148a792a7e2e7286eb151657e51accf73b61c63dc4bc196f963fc478a7e3c024e75dbf4b6e7d169e1ba1cce00f96cef47b92431605b5e3
SSDEEP

6144:sbQ1IgyL02spioEkVzntDnVtFCxf9PrCVODGdBiRTdRTK98gWNlPTGQQm6agrdWp:xIg9XioEkVndPIE2bVd3NtTird8

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	CardMp3.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\CDCard.ini	CardMp3.exe

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\CDCardMp3.Dat, 1"	CardMp3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\ = "Tale MP3Play Control"	CardMp3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\Control	CardMp3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\InprocServer32	CardMp3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\InprocServer32\ThreadingModel = "Apartment"	CardMp3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\MiscStatus\1\ = "131473"	CardMp3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\PToolboxBitmap32	CardMp3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\ProgID	CardMp3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\TypeLib	CardMp3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\Version\ = "1.0"	CardMp3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\Control\	CardMp3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\InprocServer32\ = "C:\\Windows\\SysWow64\\CDCardMp3.Dat"	CardMp3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\ProgID\ = "MP3Play.MP3PlayCtrl.1"	CardMp3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\ToolboxBitmap32	CardMp3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\Version	CardMp3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}	CardMp3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\MiscStatus	CardMp3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\MiscStatus\ = "0"	CardMp3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\MiscStatus\1	CardMp3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\PToolboxBitmap32\ = "C:\\Windows\\SysWow64\\CDCardMp3.Dat, 1"	CardMp3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3B00B10D-6EF0-11D1-A6AA-0020AFE4DE54}\TypeLib\ = "{3B00B10A-6EF0-11D1-A6AA-0020AFE4DE54}"	CardMp3.exe

C:\Users\Admin\AppData\Local\Temp\CardMaster\CardMp3.exe
"C:\Users\Admin\AppData\Local\Temp\CardMaster\CardMp3.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Modifies registry class
PID:1788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-54-0x0000000075931000-0x0000000075933000-memory.dmp

Filesize
8KB

Download
memory/1788-56-0x0000000000270000-0x00000000002B3000-memory.dmp

Filesize
268KB

Download
memory/1788-55-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1788-57-0x00000000003F0000-0x00000000003F3000-memory.dmp

Filesize
12KB

Download
memory/1788-58-0x0000000000400000-0x00000000004DF000-memory.dmp

Filesize
892KB

Download
memory/1788-59-0x0000000000270000-0x00000000002B3000-memory.dmp

Filesize
268KB

Download