General
-
Target
b7aff9d896242b310bf1ca7cafb8605b4b7f25e5b264445ce48a592f0261de9a
-
Size
305KB
-
Sample
221203-hgnegscg89
-
MD5
5c91541bed710ff95b46456d9e237a39
-
SHA1
3a0ee45775e5fb20c418f00620338e1f6e550bd7
-
SHA256
b7aff9d896242b310bf1ca7cafb8605b4b7f25e5b264445ce48a592f0261de9a
-
SHA512
0d735009a52c95d03c80bbc2cc3143e40956aadc32fd6f6cfe67bc5d1644e6f15a327a699b2f07f4df83e4d8c24a2674fb4dd65b704fad9c813d515b87f9205c
-
SSDEEP
3072:i/7hLgEqpl+/3MszTEIuZBYdlIjVXZsqdK5tp0SfVX4kELMQZjDrbqg75uN1Rx7u:XEhI+IjVXS55P02VVQZjzqgA1GV09W
Static task
static1
Behavioral task
behavioral1
Sample
b7aff9d896242b310bf1ca7cafb8605b4b7f25e5b264445ce48a592f0261de9a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b7aff9d896242b310bf1ca7cafb8605b4b7f25e5b264445ce48a592f0261de9a.exe
Resource
win10v2004-20220901-en
Malware Config
Targets
-
-
Target
b7aff9d896242b310bf1ca7cafb8605b4b7f25e5b264445ce48a592f0261de9a
-
Size
305KB
-
MD5
5c91541bed710ff95b46456d9e237a39
-
SHA1
3a0ee45775e5fb20c418f00620338e1f6e550bd7
-
SHA256
b7aff9d896242b310bf1ca7cafb8605b4b7f25e5b264445ce48a592f0261de9a
-
SHA512
0d735009a52c95d03c80bbc2cc3143e40956aadc32fd6f6cfe67bc5d1644e6f15a327a699b2f07f4df83e4d8c24a2674fb4dd65b704fad9c813d515b87f9205c
-
SSDEEP
3072:i/7hLgEqpl+/3MszTEIuZBYdlIjVXZsqdK5tp0SfVX4kELMQZjDrbqg75uN1Rx7u:XEhI+IjVXS55P02VVQZjzqgA1GV09W
Score7/10-
Deletes itself
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-