0bb7e3c0492d977fe3b32844b0bccec70a808c2f7a2e36ab0942ed8101d54783

Analysis

max time kernel
131s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-04-2024 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bbb.exe
Size

1.5MB
MD5

5a090e5cc569ba0021df79115256d0b4
SHA1

7949b5a3ca432d9d63201ce29810cfdafbde05ce
SHA256

9b8af759ea2c190423291db0d14aa4e68f78ab80f43372efddaa445b332b5b8e
SHA512

2d7f854d04652aaeeb92738cb56a93d440e1097ba70b89d2a77c4888006fcd7fb454018fbc09d56f3e23523eb5c4c5e35078543866823da3ca1161daa9882575
SSDEEP

49152:hN8BXjYmjv39rA5cHB0jIQKf0DjzPhMVkj0fvoX4QIrx:haBX0mjSmh0jIHf0DjzPhMVkj0fvoX4J

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

bbb.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion bbb.exe
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

bbb.exe

description ioc process

File opened for modification \??\PhysicalDrive0 bbb.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

bbb.exe

pid process

2076 bbb.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

bbb.exe

pid process

2076 bbb.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bbb.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	bbb.exe

pid	process
2076	bbb.exe

pid	process
2076	bbb.exe

C:\Users\Admin\AppData\Local\Temp\bbb.exe
"C:\Users\Admin\AppData\Local\Temp\bbb.exe"
1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2076

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bbb.log
Filesize
1KB

MD5
3f3e2b36678becff9b7e3e2467e1d88f

SHA1
9e54a9559bba055063db47f9dd4a330f92b209ca

SHA256
a0f1a3882400c103b1c93c927b6a6143016e36dc4d80cb6d2db77beeea28a696

SHA512
ae967ca218316d592480b095945bb3ffa48efa33a380b0ff6b33d65f454fa9831467828b01fd35980c173a8b8adce2c3ffd5e3f628c9681bfd759da1635cf5b4

Download Submit
memory/2076-0-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/2076-1-0x0000000000320000-0x000000000035F000-memory.dmp

Filesize
252KB

Download
memory/2076-2-0x0000000000360000-0x000000000037B000-memory.dmp

Filesize
108KB

Download
memory/2076-3-0x0000000000380000-0x0000000000391000-memory.dmp

Filesize
68KB

Download
memory/2076-4-0x00000000003A0000-0x00000000003EC000-memory.dmp

Filesize
304KB

Download
memory/2076-14-0x00000000020E0000-0x000000000226A000-memory.dmp

Filesize
1.5MB

Download
memory/2076-50-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/2076-51-0x0000000064F40000-0x0000000064F67000-memory.dmp

Filesize
156KB

Download
memory/2076-52-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download