Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
19/02/2024, 16:36
General
-
Target
b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416.exe
-
Size
4.5MB
-
MD5
97208007ab21ffc52c7cc01445e04fdf
-
SHA1
907515ad2fc262e4ddc5161703bfdd28163f2e0c
-
SHA256
b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416
-
SHA512
d0c4c087ee2164cfd064833fad70cb6dd7e665a8fdda44c67557e5b3f3ea1fac6f17fdc51a2b8e6e532d1823bc45910b1ea2fd7fede9bc12dcd467053867d66f
-
SSDEEP
98304:p8CWEft+AGpoPdmjfwn706B9w6rMkZFbyNQ1Ue43PZ5fMXy/1Q:OZEF+5lu7PJrWN+4B57/1Q
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 4 IoCs
-
UPX packed file 38 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416.exe"C:\Users\Admin\AppData\Local\Temp\b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\kaidisoft\changweici\b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416.exe"C:\kaidisoft\changweici\b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.3MB
MD572528a135161ae9e2baff8d0d716836b
SHA1630975ccac6bcb2adc9ce252fce236c23f7913ae
SHA256853b4a9a6d99bab17c570fb7b081ded73cf8d6a7c8d7c1a182fb67395d7312b1
SHA5120093b094306937052b6e2461c7da6f61c8d40701423c740c056ab856ae8cdf1d503ed825c47b00bd58a4f0746ef6cff35fbfce8d1aa205170c2b5213e0336f3b
-
Filesize
5.3MB
MD57b5b409205ad3c0b0fe0c6ff64b5feda
SHA162ba1c6ee8d43315046e7c8613afbf5de6e4b6f4
SHA256f47ec0193554e8e02afc9921539e50854b64db8225974e2004b8fd1538f31818
SHA51252fa9ea96ceaf090458bd361365de452c5fed63204de451b60ff34dade065468c9d751616fdab78e28595f1c3b2f3f5215eb2531e8fa0969c996c466f43b6123
-
Filesize
10.6MB
MD550c266e46ccf9bc8956279f78d51f205
SHA10ba5b98a91a9a019cd9b87cf01796c65ee6a0839
SHA256c58e066a293ff260037487d37e37bf3d890c16383d817c7573dab51c514cbd00
SHA5127350a82820faeba3172fad3d87b04c6a2967b797a321a78a53e7156c37fed4661a66d2f78e2f3ddbcbc0d10a56f5d761f7eb761f05d2841568b34841c17e0d37
-
Filesize
4.5MB
MD597208007ab21ffc52c7cc01445e04fdf
SHA1907515ad2fc262e4ddc5161703bfdd28163f2e0c
SHA256b0f79cc681ff3a9873d3f2865de774982d8dc691e1cd33e79e18b226aeeb9416
SHA512d0c4c087ee2164cfd064833fad70cb6dd7e665a8fdda44c67557e5b3f3ea1fac6f17fdc51a2b8e6e532d1823bc45910b1ea2fd7fede9bc12dcd467053867d66f
-
Filesize
866KB
MD521d897cd022552fddb5c96f6cbac9da0
SHA1a88b60acec3b752a0d1a4f02984405d2a573c99d
SHA2562101ddce70649967303b62e7a1e0d8dfa3bf45f4b1a14b2a74dc64687af28797
SHA512455c1e61654b065895a00b36f779cebb893dc64331acfd782bbbb5ba26b3fb9634ead08167acf7605a7b684d8754668390a184b31dbe793404abbb885bc0e380
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
6.4MB
-
Filesize
1024KB
-
Filesize
6.4MB
-
Filesize
64KB
-
Filesize
6.4MB
-
Filesize
1024KB
-
Filesize
64KB
-
Filesize
6.4MB
-
Filesize
6.4MB