fa42ccf36715c8a4d35fdef0875b281dc9edfe6114a478f20f2a7d8e85bad926

Analysis

max time kernel
139s
max time network
142s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
18-12-2022 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fa42ccf36715c8a4d35fdef0875b281dc9edfe6114a478f20f2a7d8e85bad926.exe
Size

555KB
MD5

014fb53f28c71b799e80e05c4d93de74
SHA1

19e7b906285ab5a7d6da490aa5a8ff927b7f4678
SHA256

fa42ccf36715c8a4d35fdef0875b281dc9edfe6114a478f20f2a7d8e85bad926
SHA512

1cf8cec9eecaa5165fda4a2bfccd91d189d8f9019ad37631c3a7544d8f1ee6876867ad7543e0af77f40377adcf20e2f91598736526dd09b1f01d6249f726bd48
SSDEEP

12288:DqD7uxqCN/ruLIeTAaHFmsUSVi5DBJc6uA1gYffI:DqD7eqnIeMalzJVi5DBJsAlffI

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	fa42ccf36715c8a4d35fdef0875b281dc9edfe6114a478f20f2a7d8e85bad926.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fa42ccf36715c8a4d35fdef0875b281dc9edfe6114a478f20f2a7d8e85bad926.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fa42ccf36715c8a4d35fdef0875b281dc9edfe6114a478f20f2a7d8e85bad926.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	fa42ccf36715c8a4d35fdef0875b281dc9edfe6114a478f20f2a7d8e85bad926.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1464	fa42ccf36715c8a4d35fdef0875b281dc9edfe6114a478f20f2a7d8e85bad926.exe
1464	fa42ccf36715c8a4d35fdef0875b281dc9edfe6114a478f20f2a7d8e85bad926.exe

C:\Users\Admin\AppData\Local\Temp\fa42ccf36715c8a4d35fdef0875b281dc9edfe6114a478f20f2a7d8e85bad926.exe
"C:\Users\Admin\AppData\Local\Temp\fa42ccf36715c8a4d35fdef0875b281dc9edfe6114a478f20f2a7d8e85bad926.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1464-56-0x00000000767C1000-0x00000000767C3000-memory.dmp

Filesize
8KB

Download
memory/1464-58-0x0000000000400000-0x0000000000634000-memory.dmp

Filesize
2.2MB

Download
memory/1464-59-0x0000000000400000-0x0000000000634000-memory.dmp

Filesize
2.2MB

Download