Analysis
-
max time kernel
141s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28-01-2024 06:52
Static task
static1
Behavioral task
behavioral1
Sample
iRoundPic_3.8.8_gb/iRoundPic.chm
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
iRoundPic_3.8.8_gb/iRoundPic.chm
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
iRoundPic_3.8.8_gb/iRoundPic.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
iRoundPic_3.8.8_gb/iRoundPic.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
iRoundPic_3.8.8_gb/新云软件.url
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
iRoundPic_3.8.8_gb/新云软件.url
Resource
win10v2004-20231222-en
General
-
Target
iRoundPic_3.8.8_gb/iRoundPic.exe
-
Size
820KB
-
MD5
d03e02cc3449895b5c9ec507c8ef5ab6
-
SHA1
28b448a129ce3d7e87e6757d07f241282859597a
-
SHA256
6956e9a3ce908c8fe78da04611770efb6b49d4b0139a1ffdbddc35e8793faea1
-
SHA512
f72e542c352db3f7cee0c22aee8455b4ece12e2a023e49e76d2a60a2e0b1a00bb55f26e3f1d425a1c6384bee96d1b71bffdfceb4a5d5f764b1b5b3f542fec6f4
-
SSDEEP
24576:qNvpJ0osDWL/COgIFV68V4Q6dFlJCAL44zGbpdtnEP:qXT/2If68B6dFlPHzKbtEP
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 iRoundPic.exe -
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\spzfile iRoundPic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\spzfile\shell iRoundPic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\spzfile\shell\open iRoundPic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\spzfile\shell\open\command iRoundPic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\spzfile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\iRoundPic_3.8.8_gb\\iRoundPic.exe\" %1" iRoundPic.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.spz iRoundPic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.spz\ = "spzfile" iRoundPic.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4904 iRoundPic.exe 4904 iRoundPic.exe