Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 02:18
Static task
static1
Behavioral task
behavioral1
Sample
2445051d662d48ebbc353b079200c631.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2445051d662d48ebbc353b079200c631.exe
Resource
win10v2004-20231215-en
General
-
Target
2445051d662d48ebbc353b079200c631.exe
-
Size
144KB
-
MD5
2445051d662d48ebbc353b079200c631
-
SHA1
aa19e56245848863db6fe8ffd0d4b9d33a1d2885
-
SHA256
addec28c814bd0598a89d148bb025b0687c6f77d365fb9d3e6910f3d3b9fe764
-
SHA512
cff79660cb5786f13185225ef74d674cc4f5e94013014ab3eba6c737003d2546071b1380fc1d15aa9fe87ea55a60e47bb4e5252f211b01147577709fe765cc9a
-
SSDEEP
3072:4FkqIlcxdGbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7bt1gtcwKMBh:OoHwvP6bQ7yMP+DE827x10lKI
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 2445051d662d48ebbc353b079200c631.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe 2445051d662d48ebbc353b079200c631.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key 2445051d662d48ebbc353b079200c631.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ 2445051d662d48ebbc353b079200c631.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" 2445051d662d48ebbc353b079200c631.exe