Analysis
-
max time kernel
142s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
IconXP/help.chm
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
IconXP/help.chm
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
IconXP/iconxp.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
IconXP/iconxp.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
IconXP/安装必看.url
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
IconXP/安装必看.url
Resource
win10v2004-20231215-en
General
-
Target
IconXP/iconxp.exe
-
Size
785KB
-
MD5
db9a0c4a9ed095e1767efcd7a89c6862
-
SHA1
eb21c4ca150955d04f3754aa171f47f01b7a123d
-
SHA256
9f645e3c5e13af0070972d62884dd0f1d21b93ddb804da61eb7dec87439191cd
-
SHA512
01d261a1d9c7df32c3bf53c0e3e2ee3deea81dca1fca9bf6dc9d87e20d6734aa0a2663fc985bc744cfb4e6a2e64c5c2227e2963cb8dd5c79b9627e7d30cca20d
-
SSDEEP
24576:4C8PexVdlk6QSQ5tKcN57rD2wyF7MP+h2ZU:tvV46GtKcN57rD2wtTU
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 iconxp.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key iconxp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ iconxp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" iconxp.exe