439adc5d418679b20dca64158189fe0e1d63f85c86c3fa1b91c469233663e41b

Resubmissions

01-04-2023 00:44

230401-a3jpeseg74 1

01-04-2023 00:40

230401-a1hpcaga91 6

Analysis

max time kernel
10s
max time network
14s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01-04-2023 00:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CMLauncher.exe
Size

14.7MB
MD5

bb3e00f34a96cce79549e72d1b1a439d
SHA1

11b57260f75f8ac1dfa39dea6098506830baf440
SHA256

463a3af1bd39ae2cd2e84286b377694a33fd740d9ed767e82569743ef184068e
SHA512

4fcf526b27ff9244c56b33bf66837f65e3a6245b3f4f4537b0d8ad81cf1a3415a5a952ba70f81cb00381dbfcef7d9792bfc47e8ee2138dfea3fb874b5d1840ae
SSDEEP

393216:JgukY3Ix2Rpa5W4WAot7j9P1pz3/ue5vy7vi2C1aE:TH38CAotn9P1pz3/ue5vlZ

Score

6^/10

bootkit persistence

Malware Config

Signatures

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

CMLauncher.exe

description	ioc	process
File opened (read-only)	\??\E:	CMLauncher.exe
File opened (read-only)	\??\F:	CMLauncher.exe
File opened (read-only)	\??\O:	CMLauncher.exe
File opened (read-only)	\??\P:	CMLauncher.exe
File opened (read-only)	\??\Q:	CMLauncher.exe
File opened (read-only)	\??\W:	CMLauncher.exe
File opened (read-only)	\??\X:	CMLauncher.exe
File opened (read-only)	\??\A:	CMLauncher.exe
File opened (read-only)	\??\H:	CMLauncher.exe
File opened (read-only)	\??\R:	CMLauncher.exe
File opened (read-only)	\??\V:	CMLauncher.exe
File opened (read-only)	\??\Y:	CMLauncher.exe
File opened (read-only)	\??\T:	CMLauncher.exe
File opened (read-only)	\??\B:	CMLauncher.exe
File opened (read-only)	\??\J:	CMLauncher.exe
File opened (read-only)	\??\K:	CMLauncher.exe
File opened (read-only)	\??\L:	CMLauncher.exe
File opened (read-only)	\??\M:	CMLauncher.exe
File opened (read-only)	\??\N:	CMLauncher.exe
File opened (read-only)	\??\S:	CMLauncher.exe
File opened (read-only)	\??\G:	CMLauncher.exe
File opened (read-only)	\??\I:	CMLauncher.exe
File opened (read-only)	\??\U:	CMLauncher.exe
File opened (read-only)	\??\Z:	CMLauncher.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

CMLauncher.exe

description ioc process

File opened for modification \??\PhysicalDrive0 CMLauncher.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

CMLauncher.exe

pid process

816 CMLauncher.exe
816 CMLauncher.exe
816 CMLauncher.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	CMLauncher.exe

pid	process
816	CMLauncher.exe
816	CMLauncher.exe
816	CMLauncher.exe

C:\Users\Admin\AppData\Local\Temp\CMLauncher.exe
"C:\Users\Admin\AppData\Local\Temp\CMLauncher.exe"
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/816-54-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/816-55-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/816-56-0x00000000003B0000-0x00000000003BA000-memory.dmp

Filesize
40KB

Download
memory/816-58-0x0000000004180000-0x00000000041E1000-memory.dmp

Filesize
388KB

Download
memory/816-59-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/816-57-0x0000000003450000-0x00000000034B8000-memory.dmp

Filesize
416KB

Download