40944a0508c93b43ee7184700dfc4a6760c66db32bf81d66c2941923fd334f6a | Triage

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 01:37

Sharing

Report Analysis Logs

General

Target

BIOS_v1.07/RS480M/SNIPE.exe
Size

1.2MB
MD5

afcce33fdd8cf259887c5540ae25394c
SHA1

def1fc638dfeb396369ad8184e9dec069811a468
SHA256

416bb20d21e743006ac3dbd0a983ffd7cb9115f17be5195dcf4324e33eabb1e6
SHA512

12bafd606d95da8a348c8a9b258746d0f4ff10fca01aeaf864014bd24ae64a35f41e99c31494d460078e42f9d1f029ad516492dc21a539993bd1a813f4f3959d
SSDEEP

24576:ZXw2So2J4jmd19DB7qyiUe5xk5yBtRnMCZCmE8D:xw2SoA2m77qbiy/zJpD

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\flash.sys	SNIPE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\flash.sys	SNIPE.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
484	Process not Found

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2936	SNIPE.exe

C:\Users\Admin\AppData\Local\Temp\BIOS_v1.07\RS480M\SNIPE.exe
"C:\Users\Admin\AppData\Local\Temp\BIOS_v1.07\RS480M\SNIPE.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of SetWindowsHookEx
PID:2936

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads