Analysis
-
max time kernel
140s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 06:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0b137ecad3580d387398c051b88834b9.exe
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
0b137ecad3580d387398c051b88834b9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
0b137ecad3580d387398c051b88834b9.exe
-
Size
696KB
-
MD5
0b137ecad3580d387398c051b88834b9
-
SHA1
67f8e74147bed92eaa07786b2b22d47896438bc9
-
SHA256
786f22f49040e4397ab83d7bc6367db9b956abdca141d85756d7bfcaa1707ac9
-
SHA512
ecdbe87ceb4b18668e3450a6cdf4b53ba03a1b5a13daffc0dac4820b7da9f69d4203e2d9067b4e85b0641acd37bc0db3c7e136f66bd283091808d24967ff11d0
-
SSDEEP
12288:tjvZNCKUReWAyoca/fiOCIwW8X+0mhVOepKBBZsQ0x6WiSCXcF/:p3UnAAa/qOGW8X+04ppVx/vp
Score
7/10
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 0b137ecad3580d387398c051b88834b9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 0b137ecad3580d387398c051b88834b9.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 0b137ecad3580d387398c051b88834b9.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0B137E~1.EXE" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\ = "OleTerminalDisp" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\ = "OleTerminalEvents" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287} 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.TerminalDispatch\ = "CommunicationTerminal.TerminalDispatch" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.Terminal 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655} 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.TerminalDispatch 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655}\ProgID 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0\FLAGS\ = "0" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\ = "TerminalDisp" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\TypeLib\ = "{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FADB651D-633B-482B-B492-7C6301C546E9}\ = "CommunicationTerminal.TerminalDispatch" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655}\ = "CommunicationTerminal.Terminal" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\TypeLib\ = "{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\TypeLib\ = "{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\TypeLib\ = "{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\ = "OleTerminalEvents" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655}\InprocHandler32 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0\0 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0\0\win32 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FADB651D-633B-482B-B492-7C6301C546E9}\ProgID 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.Terminal\CLSID\ = "{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655} 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\ = "OleTerminalDisp" 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FADB651D-633B-482B-B492-7C6301C546E9} 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655}\ProgID\ = "CommunicationTerminal.Terminal" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655} 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\TypeLib\Version = "1.0" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8CDA0645-1D1F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\TypeLib\ = "{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21} 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\ = "TerminalEvents" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.TerminalDispatch\CLSID 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FADB651D-633B-482B-B492-7C6301C546E9}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0B137E~1.EXE" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.Terminal\CLSID 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0\HELPDIR 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{45986AB1-1D2F-11D5-94BD-00C0DFEDB655}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\ProxyStubClsid32 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655} 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655}\InprocHandler32\ = "ole32.dll" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8CDA0646-1D1F-11D5-94BD-00C0DFEDB655}\LocalServer32 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{45986AB2-1D2F-11D5-94BD-00C0DFEDB655}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0b137ecad3580d387398c051b88834b9.exe" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21} 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C50A1E26-0769-4023-8830-52CB1B6A4F21}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75E859AC-C9E1-4F44-AC2A-B24304370287}\TypeLib 0b137ecad3580d387398c051b88834b9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FADB651D-633B-482B-B492-7C6301C546E9}\LocalServer32 0b137ecad3580d387398c051b88834b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CommunicationTerminal.Terminal\ = "CommunicationTerminal.Terminal" 0b137ecad3580d387398c051b88834b9.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1872 0b137ecad3580d387398c051b88834b9.exe Token: SeIncBasePriorityPrivilege 1872 0b137ecad3580d387398c051b88834b9.exe Token: 33 1872 0b137ecad3580d387398c051b88834b9.exe Token: SeIncBasePriorityPrivilege 1872 0b137ecad3580d387398c051b88834b9.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1872 0b137ecad3580d387398c051b88834b9.exe 1872 0b137ecad3580d387398c051b88834b9.exe 1872 0b137ecad3580d387398c051b88834b9.exe 1872 0b137ecad3580d387398c051b88834b9.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28 PID 1928 wrote to memory of 1872 1928 0b137ecad3580d387398c051b88834b9.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b137ecad3580d387398c051b88834b9.exe"C:\Users\Admin\AppData\Local\Temp\0b137ecad3580d387398c051b88834b9.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\0b137ecad3580d387398c051b88834b9.exe"C:\Users\Admin\AppData\Local\Temp\0b137ecad3580d387398c051b88834b9.exe"2⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1872
-