Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 02:52
Static task
static1
Behavioral task
behavioral1
Sample
0c38405eb475b19e2fe13e7b0e384aba.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0c38405eb475b19e2fe13e7b0e384aba.exe
Resource
win10v2004-20231215-en
General
-
Target
0c38405eb475b19e2fe13e7b0e384aba.exe
-
Size
118KB
-
MD5
0c38405eb475b19e2fe13e7b0e384aba
-
SHA1
06b06c205c20b962b8965c47ccafb8d4b2acc6d8
-
SHA256
243961d748553f967421ecbde0fbb8d3bf2c24c001a6ce4519a3d1aeb59e9938
-
SHA512
a29725b6364f0a8fb4f200f3d85842c3964203b4da0496ebd0ff127636839a885877bf1dd8f3a828a8662ba9d57bebb9eed09e5ef32b8ab3da889e98c1ee748a
-
SSDEEP
3072:mf3WH0ZbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7GjJ:mf3c0BwvP6bQ7yMP+DE827sJ
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 0c38405eb475b19e2fe13e7b0e384aba.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38} 0c38405eb475b19e2fe13e7b0e384aba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\dlloadtime = "1704025371" 0c38405eb475b19e2fe13e7b0e384aba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\mac = "4E-2C-21-FE-B0-7B" 0c38405eb475b19e2fe13e7b0e384aba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F9BA1AA9-CAD4-4C14-BDE6-922DFF5F6F38}\dlt = "1704025371" 0c38405eb475b19e2fe13e7b0e384aba.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 0c38405eb475b19e2fe13e7b0e384aba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 0c38405eb475b19e2fe13e7b0e384aba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 0c38405eb475b19e2fe13e7b0e384aba.exe