Overview

overview

7

Static

static

3

CPU-Z-v2.09.0-CN.exe

windows7-x64

7

CPU-Z-v2.09.0-CN.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CPU-Z-v2.09.0-CN.exe

  • Size

    1.7MB

  • Sample

    240420-n488csgh21

  • MD5

    2d996f7868c3fb0383942eeed07dae55

  • SHA1

    aac00b639704a3d0cc7d0237b0e632cf61c7d999

  • SHA256

    5759d8a927e8a4fb89864a6458066b44f3f6473330b64ffb11cea36d787e5817

  • SHA512

    7fa87d28c01ca8155ef934aa347def38f7a8ce5b2b540641a757cc3334ed897eac93f8915cf9b9bce0a6c59b930dcfe23a5b695df88e0c16e6331ab303c1024f

  • SSDEEP

    49152:ogwRiSwujx1x9d8ug+iRj0XFGEVRlgmy/VV:ogwRituP18JCHRcL

Score
7/10
bootkitpersistence

Malware Config

Targets

    • Target

      CPU-Z-v2.09.0-CN.exe

    • Size

      1.7MB

    • MD5

      2d996f7868c3fb0383942eeed07dae55

    • SHA1

      aac00b639704a3d0cc7d0237b0e632cf61c7d999

    • SHA256

      5759d8a927e8a4fb89864a6458066b44f3f6473330b64ffb11cea36d787e5817

    • SHA512

      7fa87d28c01ca8155ef934aa347def38f7a8ce5b2b540641a757cc3334ed897eac93f8915cf9b9bce0a6c59b930dcfe23a5b695df88e0c16e6331ab303c1024f

    • SSDEEP

      49152:ogwRiSwujx1x9d8ug+iRj0XFGEVRlgmy/VV:ogwRituP18JCHRcL

    Score
    7/10
    bootkitpersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks