Analysis
-
max time kernel
316s -
max time network
410s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04-12-2022 02:45
Static task
static1
Behavioral task
behavioral1
Sample
62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe
Resource
win10v2004-20221111-en
General
-
Target
62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe
-
Size
146KB
-
MD5
8ea1279367d8fddb94d76d9b5b4cf146
-
SHA1
91fd5069dc91052ae6cf0801f6bfaeb9f5db072d
-
SHA256
62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a
-
SHA512
cfd5d091af969fb4c21e98f08426712c3a0280d355a78b81c87d6b360fa82fbfc4832e3e25019f394342b7a57228e3c8ba828aa8c918a6b56aaede27ea65c655
-
SSDEEP
3072:EJU9ULrLIDjMSmoSsI4lC9mx0Mxtus4URyFkMN29AEK8hJuNpSUtq9s9x:EJbIUjoSC7GUYU8k1F4pMs
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
fkp.exepid process 1268 fkp.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exedescription ioc process File opened for modification \??\PhysicalDrive0 62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exefkp.exepid process 3104 62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe 1268 fkp.exe 3104 62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exedescription pid process target process PID 3104 wrote to memory of 1268 3104 62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe fkp.exe PID 3104 wrote to memory of 1268 3104 62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe fkp.exe PID 3104 wrote to memory of 1268 3104 62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe fkp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe"C:\Users\Admin\AppData\Local\Temp\62916133d80f8525fcbb2a335c33730fea49866241db36419b3c64fc87d2110a.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fkp.exe"C:\Users\Admin\AppData\Local\Temp\fkp.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\fkp.exeFilesize
7KB
MD5a4974058f1f6e7ddb9f9316f25dd84c2
SHA1ad41a5245fc571a78ce768a22b2a5020c9459a49
SHA25616c7096b10cb37aa25ed8f41c16591b33a3a0d5d1a5f132c67616d75acbe5ddd
SHA5127a87db56ea397971b0fe72a6fac848f9aee7de344dfce891980eaffc250460cf3fdcff2ce0f6d46f379598f60be42940a732e4b2e91a169613da89b0f5babeda
-
C:\Users\Admin\AppData\Local\Temp\fkp.exeFilesize
7KB
MD5a4974058f1f6e7ddb9f9316f25dd84c2
SHA1ad41a5245fc571a78ce768a22b2a5020c9459a49
SHA25616c7096b10cb37aa25ed8f41c16591b33a3a0d5d1a5f132c67616d75acbe5ddd
SHA5127a87db56ea397971b0fe72a6fac848f9aee7de344dfce891980eaffc250460cf3fdcff2ce0f6d46f379598f60be42940a732e4b2e91a169613da89b0f5babeda
-
memory/1268-133-0x0000000000000000-mapping.dmp
-
memory/1268-136-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1268-138-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/3104-132-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB
-
memory/3104-137-0x0000000000400000-0x000000000045C000-memory.dmpFilesize
368KB