Overview
overview
6Static
static
3BadCopy.chm
windows7-x64
1BadCopy.chm
windows10-2004-x64
1BadCopyEng.exe
windows7-x64
6BadCopyEng.exe
windows10-2004-x64
1advisor.htm
windows7-x64
1advisor.htm
windows10-2004-x64
1badcopy.exe
windows7-x64
1badcopy.exe
windows10-2004-x64
1soft2cn....��.exe
windows7-x64
1soft2cn....��.exe
windows10-2004-x64
1安装说明.url
windows7-x64
1安装说明.url
windows10-2004-x64
1汉化手记.url
windows7-x64
1汉化手记.url
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
20/07/2024, 00:40
Static task
static1
Behavioral task
behavioral1
Sample
BadCopy.chm
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
BadCopy.chm
Resource
win10v2004-20240704-en
Behavioral task
behavioral3
Sample
BadCopyEng.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
BadCopyEng.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
advisor.htm
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
advisor.htm
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
badcopy.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
badcopy.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
soft2cn.com汉化说明.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
soft2cn.com汉化说明.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
安装说明.url
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
安装说明.url
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
汉化手记.url
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
汉化手记.url
Resource
win10v2004-20240709-en
General
-
Target
BadCopyEng.exe
-
Size
634KB
-
MD5
0a75cdf1935a1eb1e03a1a431e16e47e
-
SHA1
fdf610ac52b02bafa022462fec68233307f4769a
-
SHA256
c2556d888dafa5b1eb4bf8d633f8c140a8b926f01f258b32a61adaa7e6c52ecc
-
SHA512
9ff810927dcabac860e1a738cfd94f30ca4d6c8b6964bfc906a46aa6256bea2e2118e8ffb65fe13dbbebff2512664aaec4a857f463abd25153fc52c69079adf0
-
SSDEEP
12288:VCCVrX1Yld/kQ9EEOUhBafcfoIbZej9SCTEYQ6b7MP+Dd2d:VCCVrihRrl2WyjTTBx7MP+h2d
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 BadCopyEng.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key BadCopyEng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ BadCopyEng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" BadCopyEng.exe