07e5eb7afa89d6147407187828fa9d8744844b59cd1f4ac46a51c34a4ee7bbb0

Analysis

max time kernel
141s
max time network
20s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 05:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

CJ_ZJJJS_CZSS4.2/ExamBible.exe
Size

1.4MB
MD5

f2514dca923340fc8d7684ec842d3fba
SHA1

0f6e27e37b7abb92947b4174332f8de635a3ab12
SHA256

238b1a66ed9966cf4a3d4af0f81d7daac7e98bc14836a4dad218e1a41d0ed276
SHA512

81d7e7d56f958e8c9898c8e64124009c07dc8747a05adfd467415cdf0387aaf20b0c8024f3dd90ab78b437d0b0f2e4fc59ed95dfbb874aae59c7ead9f45cb254
SSDEEP

24576:b1NVNQDGHmSupJURxLJsZ+Vh/sfZ05efWvG2uH3dIO+FoxY9h:pX6GzupJURxLJsS/mZ05gx2uHSO+FoK

Score

6^/10

bootkit persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	ExamBible.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	ExamBible.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ExamBible.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ExamBible.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\Clsid\ = "{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1\Clsid	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\ = "Borland Midas type library"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\0	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\Clsid	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\ProgID	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\InProcServer32	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\ProgID\ = "Borland.Midas_DSBase.1"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor.1	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\CurVer\ = "Borland.Midas_DSBase.1"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase.1\Clsid	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\FLAGS	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\HELPDIR	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\Clsid	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1\ = "Borland Midas DatapacketRead"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\ = "Borland Midas DSCursor Current"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\ProgID\ = "Borland.Midas_DatapacketWrite.1"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib\Version = "1.0"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\ = "Borland Midas DSBase Current"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\Clsid\ = "{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\VersionIndependentProgID\ = "Borland.Midas_DSCursor"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\0\win32	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase\CurVer	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\ProgID\ = "Borland.Midas_DSCursor.1"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\FLAGS\ = "0"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase.1\Clsid\ = "{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DSCursor 1"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\ProgID	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSBase.1	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DSBase 1"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\CurVer	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ThreadingModel = "Apartment"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DatapacketWrite"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ProxyStubClsid32	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ProxyStubClsid32	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor\CurVer\ = "Borland.Midas_DSCursor.1"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\ProgID	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DSCursor.1\ = "Borland Midas DSCursor 1"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA3-591C-11D0-BF52-0020AF32BD64}\InProcServer32	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\ = "IAppServer"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib\Version = "1.0"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1\Clsid\ = "{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA5-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CJ_ZJJJS_CZSS4.2\\MIDAS.DLL"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{83F57D68-CA9A-11D2-9088-00C04FA35CFA}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CJ_ZJJJS_CZSS4.2"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketRead.1	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Borland.Midas_DatapacketWrite.1\ = "Borland Midas DatapacketWrite"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\ProgID\ = "Borland.Midas_DatapacketRead.1"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CJ_ZJJJS_CZSS4.2\\MIDAS.DLL"	ExamBible.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1AEFCC20-7A24-11D2-98B0-C69BEB4B5B6D}\TypeLib	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA1-591C-11D0-BF52-0020AF32BD64}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\CJ_ZJJJS_CZSS4.2\\MIDAS.DLL"	ExamBible.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9E8D2FA7-591C-11D0-BF52-0020AF32BD64}\ = "Borland Midas DatapacketRead"	ExamBible.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1596	ExamBible.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1596	ExamBible.exe
1596	ExamBible.exe
1596	ExamBible.exe
1596	ExamBible.exe
1596	ExamBible.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1596	ExamBible.exe
1596	ExamBible.exe

C:\Users\Admin\AppData\Local\Temp\CJ_ZJJJS_CZSS4.2\ExamBible.exe
"C:\Users\Admin\AppData\Local\Temp\CJ_ZJJJS_CZSS4.2\ExamBible.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CJ_ZJJJS_CZSS4.2\Menu\Test.html

Filesize
232KB

MD5
afe7733f2688dd848d0374b1e559cd29

SHA1
5a1d90b8b84ee066f519fadbb2a79fdffefe14f1

SHA256
d02d51c73909a8aa7a48d23080fdb436899104ab0ea3dc67a61b5bdf0bc9a8c1

SHA512
70bf9ced2bb163f73144c5e6e092405a03c41e6d1633342fb785341fe8257ee3cabd5723265c09b471741a04f9d837cc5064c2b35b7c2d9c1866bfe205888880

Download Submit
memory/1596-13-0x0000000000405000-0x0000000000406000-memory.dmp

Filesize
4KB

Download
memory/1596-12-0x00000000024A0000-0x00000000025E0000-memory.dmp

Filesize
1.2MB

Download
memory/1596-7-0x00000000024A0000-0x00000000025E0000-memory.dmp

Filesize
1.2MB

Download
memory/1596-0-0x0000000000400000-0x000000000078A000-memory.dmp

Filesize
3.5MB

Download
memory/1596-5-0x00000000024A0000-0x00000000025E0000-memory.dmp

Filesize
1.2MB

Download
memory/1596-11-0x00000000024A0000-0x00000000025E0000-memory.dmp

Filesize
1.2MB

Download
memory/1596-16-0x0000000000400000-0x000000000078A000-memory.dmp

Filesize
3.5MB

Download
memory/1596-15-0x0000000000400000-0x000000000078A000-memory.dmp

Filesize
3.5MB

Download
memory/1596-2-0x00000000024A0000-0x00000000025E0000-memory.dmp

Filesize
1.2MB

Download
memory/1596-14-0x0000000000400000-0x000000000078A000-memory.dmp

Filesize
3.5MB

Download
memory/1596-3-0x00000000024A0000-0x00000000025E0000-memory.dmp

Filesize
1.2MB

Download
memory/1596-9-0x00000000024A0000-0x00000000025E0000-memory.dmp

Filesize
1.2MB

Download
memory/1596-8-0x00000000024A0000-0x00000000025E0000-memory.dmp

Filesize
1.2MB

Download
memory/1596-6-0x00000000024A0000-0x00000000025E0000-memory.dmp

Filesize
1.2MB

Download
memory/1596-4-0x00000000024A0000-0x00000000025E0000-memory.dmp

Filesize
1.2MB

Download
memory/1596-1-0x0000000000020000-0x000000000002B000-memory.dmp

Filesize
44KB

Download
memory/1596-44-0x000000004DAE0000-0x000000004DB31000-memory.dmp

Filesize
324KB

Download
memory/1596-45-0x0000000000400000-0x000000000078A000-memory.dmp

Filesize
3.5MB

Download
memory/1596-51-0x000000004DAE0000-0x000000004DB31000-memory.dmp

Filesize
324KB

Download