Analysis
-
max time kernel
0s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 00:08
Behavioral task
behavioral1
Sample
1bca17593875f45fede3d5421f57df94.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1bca17593875f45fede3d5421f57df94.exe
Resource
win10v2004-20231215-en
General
-
Target
1bca17593875f45fede3d5421f57df94.exe
-
Size
338KB
-
MD5
1bca17593875f45fede3d5421f57df94
-
SHA1
7aca31f1b282aa62d64c9ef473c1eff39a386ebb
-
SHA256
3e6ff6b35c7a3fdff01aabe8c8e7e810e7a70ab705f2df1dcc5b800bb89a873a
-
SHA512
62290d00f01eaffdfff1435b8131236d9db5e48e80de20b5330e9d0199bce1c90e59229ab59073a7b73b5a5f474c9a17548fabb5cca5914849b27955e08a9ab5
-
SSDEEP
6144:9A5wVdCy6wrbDY0rDqTWC4zEDzKuTrSbxc97cf2UHAKmy6SG4AQuJ6Io9rni8:9jyy64VrDqTWIzW+9Y+Z5y6iXuC9rnB
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1684-0-0x0000000000400000-0x00000000004BE000-memory.dmp upx behavioral1/memory/1684-56-0x0000000000400000-0x00000000004BE000-memory.dmp upx behavioral1/memory/1684-57-0x0000000000400000-0x00000000004BE000-memory.dmp upx -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\v: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\y: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\g: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\i: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\n: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\s: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\x: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\z: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\e: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\h: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\l: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\r: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\m: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\o: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\q: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\t: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\u: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\w: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\j: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\k: 1bca17593875f45fede3d5421f57df94.exe File opened (read-only) \??\p: 1bca17593875f45fede3d5421f57df94.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 1bca17593875f45fede3d5421f57df94.exe